diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2012-01-07 21:11:37 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2012-01-07 21:11:37 +0000 |
| commit | 7f9a11346474a5b6c1772724a7fa33dee67b6628 (patch) | |
| tree | 598fb16c564b31f12c0ac64adb30955207d67d86 /usr.bin | |
| parent | dd0852f29a9f5f936778cbfbe472c3a31039f839 (diff) | |
fix double-free in new session handler
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ssh/mux.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/usr.bin/ssh/mux.c b/usr.bin/ssh/mux.c index d8a7b07e78f..0e78800a2d9 100644 --- a/usr.bin/ssh/mux.c +++ b/usr.bin/ssh/mux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mux.c,v 1.33 2011/12/04 23:16:12 djm Exp $ */ +/* $OpenBSD: mux.c,v 1.34 2012/01/07 21:11:36 djm Exp $ */ /* * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> * @@ -324,10 +324,8 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r) env_len = 0; while (buffer_len(m) > 0) { #define MUX_MAX_ENV_VARS 4096 - if ((cp = buffer_get_string_ret(m, &len)) == NULL) { - xfree(cmd); + if ((cp = buffer_get_string_ret(m, &len)) == NULL) goto malf; - } if (!env_permitted(cp)) { xfree(cp); continue; |