aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorAndreas Schneider <asn@cryptomilk.org>2012-10-05 14:46:36 +0200
committerAndreas Schneider <asn@cryptomilk.org>2012-11-14 17:36:24 +0100
commit571dc4233530e47fd2300b0fe42ddf6b830ded37 (patch)
tree3b41c46cc81b8774ff7e0bf0626a5e0546ac3c8b /src
parent68d04c8e47b7b4c4c6faadcf8ff2c7a3d2a936c6 (diff)
downloadlibssh-571dc4233530e47fd2300b0fe42ddf6b830ded37.tar.gz
libssh-571dc4233530e47fd2300b0fe42ddf6b830ded37.tar.xz
libssh-571dc4233530e47fd2300b0fe42ddf6b830ded37.zip
CVE-2012-4559: Make sure we don't free name and longname twice on error.
Diffstat (limited to 'src')
-rw-r--r--src/sftp.c26
1 files changed, 16 insertions, 10 deletions
diff --git a/src/sftp.c b/src/sftp.c
index 0a90e662..ee86107b 100644
--- a/src/sftp.c
+++ b/src/sftp.c
@@ -1165,8 +1165,8 @@ static char *sftp_parse_longname(const char *longname,
so that number of pairs equals extended_count */
static sftp_attributes sftp_parse_attr_3(sftp_session sftp, ssh_buffer buf,
int expectname) {
- ssh_string longname = NULL;
- ssh_string name = NULL;
+ ssh_string longname;
+ ssh_string name;
sftp_attributes attr;
uint32_t flags = 0;
int ok = 0;
@@ -1181,19 +1181,27 @@ static sftp_attributes sftp_parse_attr_3(sftp_session sftp, ssh_buffer buf,
/* This isn't really a loop, but it is like a try..catch.. */
do {
if (expectname) {
- if ((name = buffer_get_ssh_string(buf)) == NULL ||
- (attr->name = ssh_string_to_char(name)) == NULL) {
- break;
+ name = buffer_get_ssh_string(buf);
+ if (name == NULL) {
+ break;
}
+ attr->name = ssh_string_to_char(name);
ssh_string_free(name);
+ if (attr->name == NULL) {
+ break;
+ }
ssh_log(sftp->session, SSH_LOG_RARE, "Name: %s", attr->name);
- if ((longname=buffer_get_ssh_string(buf)) == NULL ||
- (attr->longname=ssh_string_to_char(longname)) == NULL) {
- break;
+ longname = buffer_get_ssh_string(buf);
+ if (longname == NULL) {
+ break;
}
+ attr->longname = ssh_string_to_char(longname);
ssh_string_free(longname);
+ if (attr->longname == NULL) {
+ break;
+ }
/* Set owner and group if we talk to openssh and have the longname */
if (ssh_get_openssh_version(sftp->session)) {
@@ -1298,8 +1306,6 @@ static sftp_attributes sftp_parse_attr_3(sftp_session sftp, ssh_buffer buf,
if (!ok) {
/* break issued somewhere */
- ssh_string_free(name);
- ssh_string_free(longname);
ssh_string_free(attr->extended_type);
ssh_string_free(attr->extended_data);
SAFE_FREE(attr->name);