diff options
| author | Andreas Schneider <asn@cryptomilk.org> | 2012-10-05 14:38:29 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2012-11-14 17:36:24 +0100 |
| commit | 68d04c8e47b7b4c4c6faadcf8ff2c7a3d2a936c6 (patch) | |
| tree | 886a91fced3432ed83781aaa63ef3ffd4b5f2a04 /src | |
| parent | bd3acae4f3ce82d2be22674d6381431cf9f54d6f (diff) | |
| download | libssh-68d04c8e47b7b4c4c6faadcf8ff2c7a3d2a936c6.tar.gz libssh-68d04c8e47b7b4c4c6faadcf8ff2c7a3d2a936c6.tar.xz libssh-68d04c8e47b7b4c4c6faadcf8ff2c7a3d2a936c6.zip | |
CVE-2012-4559: Ensure that we don't free req twice.
Diffstat (limited to 'src')
| -rw-r--r-- | src/channels.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/channels.c b/src/channels.c index a4733809..1a0baf19 100644 --- a/src/channels.c +++ b/src/channels.c @@ -1525,6 +1525,7 @@ static int channel_request(ssh_channel channel, const char *request, buffer_add_ssh_string(session->out_buffer, req) < 0 || buffer_add_u8(session->out_buffer, reply == 0 ? 0 : 1) < 0) { ssh_set_error_oom(session); + ssh_string_free(req); goto error; } ssh_string_free(req); @@ -1584,7 +1585,6 @@ pending: return rc; error: buffer_reinit(session->out_buffer); - ssh_string_free(req); leave_function(); return rc; |