don't leak 'setp' on error; noted by Nicholas Lemonias; ok djm@

1 files changed, 13 insertions, 10 deletions

diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c
index 297175487e6..6d5e2a7b510 100644
--- a/usr.bin/ssh/packet.c
+++ b/usr.bin/ssh/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.209 2015/03/11 00:48:39 jsg Exp $ */
+/* $OpenBSD: packet.c,v 1.210 2015/03/24 20:10:08 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1268,10 +1268,8 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
 	 * Since we are blocking, ensure that all written packets have
 	 * been sent.
 	 */
-	if ((r = ssh_packet_write_wait(ssh)) != 0) {
-		free(setp);
-		return r;
-	}
+	if ((r = ssh_packet_write_wait(ssh)) != 0)
+		goto out;
 
 	/* Stay in the loop until we have received a complete packet. */
 	for (;;) {
@@ -1328,15 +1326,20 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
 			len = roaming_read(state->connection_in, buf,
 			    sizeof(buf), &cont);
 		} while (len == 0 && cont);
-		if (len == 0)
-			return SSH_ERR_CONN_CLOSED;
-		if (len < 0)
-			return SSH_ERR_SYSTEM_ERROR;
+		if (len == 0) {
+			r = SSH_ERR_CONN_CLOSED;
+			goto out;
+		}
+		if (len < 0) {
+			r = SSH_ERR_SYSTEM_ERROR;
+			goto out;
+		}
 
 		/* Append it to the buffer. */
 		if ((r = ssh_packet_process_incoming(ssh, buf, len)) != 0)
-			return r;
+			goto out;
 	}
+ out:
 	free(setp);
 	return r;
 }