From 804ac21381d6f7ef985b5d69686f496fb0e14ad5 Mon Sep 17 00:00:00 2001 From: Simon Tatham Date: Sun, 10 Mar 2019 19:25:21 +0000 Subject: [PATCH] Check the return value from ssh2_transport_filter_queue! I carefully made it return a bool to indicate that the whole PPL had been freed, and then never actually checked that return value, so any kind of connection-fatal event inside filter_queue (such as reporting a DISCONNECT message) would cause a reference to freed memory on return. --- ssh2transport.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssh2transport.c b/ssh2transport.c index bcb1fee6..8640d89d 100644 --- a/ssh2transport.c +++ b/ssh2transport.c @@ -408,7 +408,8 @@ static bool ssh2_transport_filter_queue(struct ssh2_transport_state *s) PktIn *ssh2_transport_pop(struct ssh2_transport_state *s) { - ssh2_transport_filter_queue(s); + if (ssh2_transport_filter_queue(s)) + return NULL; /* we've been freed */ return pq_pop(s->ppl.in_pq); } @@ -988,7 +989,8 @@ static void ssh2_transport_process_queue(PacketProtocolLayer *ppl) * from, even if we're _not_ looping on pq_pop. That way we can * still proactively handle those messages even if we're waiting * for a user response. */ - ssh2_transport_filter_queue(s); + if (ssh2_transport_filter_queue(s)) + return; /* we've been freed */ crBegin(s->crState);