From 3334443089c56f1d4a2922fe34c6204528ad9bd3 Mon Sep 17 00:00:00 2001 From: Jon Simons Date: Tue, 29 Jan 2019 20:17:20 -0500 Subject: dh: plug pubkey_blob leak in ssh_server_dh_process_init Ensure to `SSH_STRING_FREE` the pubkey_blob local in `ssh_server_dh_process_init`. The leak can be seen with valgrind and the pkd tests with: valgrind \ --leak-check=full \ --show-leak-kinds=definite \ ./pkd_hello -i1 -t torture_pkd_openssh_rsa_rsa_diffie_hellman_group14_sha1 Signed-off-by: Jon Simons Reviewed-by: Andreas Schneider --- src/dh.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/dh.c b/src/dh.c index 9deea8d5..b4b988d9 100644 --- a/src/dh.c +++ b/src/dh.c @@ -690,7 +690,8 @@ int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet) pubkey_blob, session->next_crypto->f, sig_blob); - ssh_string_free(sig_blob); + SSH_STRING_FREE(sig_blob); + SSH_STRING_FREE(pubkey_blob); if(rc != SSH_OK) { ssh_set_error_oom(session); ssh_buffer_reinit(session->out_buffer); @@ -717,6 +718,8 @@ error: if (!bignum_ctx_invalid(ctx)) { bignum_ctx_free(ctx); } + SSH_STRING_FREE(sig_blob); + SSH_STRING_FREE(pubkey_blob); session->session_state = SSH_SESSION_STATE_ERROR; ssh_dh_cleanup(session->next_crypto); -- cgit v1.2.3