nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-26 09:42:25 +00:00
Code Issues Projects Releases Wiki Activity

Cancelling a remote port forwarding that had been refused by the server caused

Browse Source 
a double-free. Reported and diagnosed by Sven Schaepe.
Also fix a minor memory leak in ssh_free().

[originally from svn r8975]
This commit is contained in:
Jacob Nevins 2010-07-30 20:47:03 +00:00
parent fb64d89902
commit 8b294eb8c9
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ssh.c
View File

@ -4350,6 +4350,7 @@ static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
rpf = del234(ssh->rportfwds, pf); rpf = del234(ssh->rportfwds, pf);
assert(rpf == pf); assert(rpf == pf);
pf->pfrec->remote = NULL;
free_rportfwd(pf); free_rportfwd(pf);
} }
} }
@ -4526,6 +4527,8 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
logeventf(ssh, "Cancelling %s", message); logeventf(ssh, "Cancelling %s", message);
sfree(message); sfree(message);
/* epf->remote or epf->local may be NULL if setting up a
* forwarding failed. */
if (epf->remote) { if (epf->remote) {
struct ssh_rportfwd *rpf = epf->remote; struct ssh_rportfwd *rpf = epf->remote;
struct Packet *pktout; struct Packet *pktout;
@ -9346,7 +9349,7 @@ static void ssh_free(void *handle)
if (ssh->rportfwds) { if (ssh->rportfwds) {
while ((pf = delpos234(ssh->rportfwds, 0)) != NULL) while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
sfree(pf); free_rportfwd(pf);
freetree234(ssh->rportfwds); freetree234(ssh->rportfwds);
ssh->rportfwds = NULL; ssh->rportfwds = NULL;
} }