From e4b6a7efd2cab27a681c9a832f6c650abf57c7be Mon Sep 17 00:00:00 2001 From: Simon Tatham Date: Fri, 3 Apr 2020 17:53:36 +0100 Subject: [PATCH] Fix null-dereference in ssh2_channel_response. In the SSH-2 connection layer, an outstanding_channel_request structure comes with a handler to be called back with the reply packet, when the other end sends one. But sometimes it doesn't - if the channel begins to close before the request has been replied to - in which case the handler function is called with a NULL packet pointer. The common ssh2_channel_response function that handles most of the client-side channel requests was not prepared to cope with that pointer being null. Fixed by making it handle a null return the same as CHANNEL_FAILURE. --- ssh2connection-client.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ssh2connection-client.c b/ssh2connection-client.c index f4121315..be3aafe8 100644 --- a/ssh2connection-client.c +++ b/ssh2connection-client.c @@ -334,7 +334,11 @@ SshChannel *ssh2_serverside_agent_open(ConnectionLayer *cl, Channel *chan) static void ssh2_channel_response( struct ssh2_channel *c, PktIn *pkt, void *ctx) { - chan_request_response(c->chan, pkt->type == SSH2_MSG_CHANNEL_SUCCESS); + /* If pkt==NULL (because this handler has been called in response + * to CHANNEL_CLOSE arriving while the request was still + * outstanding), we treat that the same as CHANNEL_FAILURE. */ + chan_request_response(c->chan, + pkt && pkt->type == SSH2_MSG_CHANNEL_SUCCESS); } void ssh2channel_start_shell(SshChannel *sc, bool want_reply)