From 0987e6065c86f2f52b3c8835a0ad73d7ad082121 Mon Sep 17 00:00:00 2001
From: Dirkjan Bussink <d.bussink@gmail.com>
Date: Thu, 10 Dec 2020 14:14:11 +0000
Subject: [PATCH] Always check return value of ssh_list_new()

Another item identified during code review was cases where the return
value of ssh_list_new() was not properly checked and handled. This
updates all cases that were missing this to handle failure to allocate a
new list.

Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
---
 src/channels.c                      |  7 ++++++
 src/knownhosts.c                    |  1 +
 src/messages.c                      | 38 +++++++++++++++++------------
 src/packet.c                        | 12 +++++----
 tests/unittests/torture_callbacks.c |  5 ++++
 5 files changed, 42 insertions(+), 21 deletions(-)

diff --git a/src/channels.c b/src/channels.c
index 607bd568..6747a841 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -117,6 +117,13 @@ ssh_channel ssh_channel_new(ssh_session session)
 
     if (session->channels == NULL) {
         session->channels = ssh_list_new();
+        if (session->channels == NULL) {
+            ssh_set_error_oom(session);
+            SSH_BUFFER_FREE(channel->stdout_buffer);
+            SSH_BUFFER_FREE(channel->stderr_buffer);
+            SAFE_FREE(channel);
+            return NULL;
+        }
     }
 
     ssh_list_prepend(session->channels, channel);
diff --git a/src/knownhosts.c b/src/knownhosts.c
index fed75f90..f2ef088c 100644
--- a/src/knownhosts.c
+++ b/src/knownhosts.c
@@ -372,6 +372,7 @@ struct ssh_list *ssh_known_hosts_get_algorithms(ssh_session session)
 
     list = ssh_list_new();
     if (list == NULL) {
+        ssh_set_error_oom(session);
         SAFE_FREE(host_port);
         return NULL;
     }
diff --git a/src/messages.c b/src/messages.c
index 25683b23..c7fcc887 100644
--- a/src/messages.c
+++ b/src/messages.c
@@ -513,24 +513,30 @@ static int ssh_message_termination(void *s){
  * @warning This function blocks until a message has been received. Betterset up
  *          a callback if this behavior is unwanted.
  */
-ssh_message ssh_message_get(ssh_session session) {
-  ssh_message msg = NULL;
-  int rc;
+ssh_message ssh_message_get(ssh_session session)
+{
+    ssh_message msg = NULL;
+    int rc;
 
-  msg=ssh_message_pop_head(session);
-  if(msg) {
-      return msg;
-  }
-  if(session->ssh_message_list == NULL) {
-      session->ssh_message_list = ssh_list_new();
-  }
-  rc = ssh_handle_packets_termination(session, SSH_TIMEOUT_USER,
-      ssh_message_termination, session);
-  if(rc || session->session_state == SSH_SESSION_STATE_ERROR)
-    return NULL;
-  msg=ssh_list_pop_head(ssh_message, session->ssh_message_list);
+    msg = ssh_message_pop_head(session);
+    if (msg != NULL) {
+        return msg;
+    }
+    if (session->ssh_message_list == NULL) {
+        session->ssh_message_list = ssh_list_new();
+        if (session->ssh_message_list == NULL) {
+            ssh_set_error_oom(session);
+            return NULL;
+        }
+    }
+    rc = ssh_handle_packets_termination(session, SSH_TIMEOUT_USER,
+                                        ssh_message_termination, session);
+    if (rc || session->session_state == SSH_SESSION_STATE_ERROR) {
+        return NULL;
+    }
+    msg = ssh_list_pop_head(ssh_message, session->ssh_message_list);
 
-  return msg;
+    return msg;
 }
 
 /**
diff --git a/src/packet.c b/src/packet.c
index 2d376620..93591565 100644
--- a/src/packet.c
+++ b/src/packet.c
@@ -1422,12 +1422,14 @@ void ssh_packet_register_socket_callback(ssh_session session, ssh_socket s){
  * @brief sets the callbacks for the packet layer
  */
 void ssh_packet_set_callbacks(ssh_session session, ssh_packet_callbacks callbacks){
-  if(session->packet_callbacks == NULL){
-    session->packet_callbacks = ssh_list_new();
-  }
-  if (session->packet_callbacks != NULL) {
+    if (session->packet_callbacks == NULL) {
+        session->packet_callbacks = ssh_list_new();
+        if (session->packet_callbacks == NULL) {
+            ssh_set_error_oom(session);
+            return;
+        }
+    }
     ssh_list_append(session->packet_callbacks, callbacks);
-  }
 }
 
 /** @internal
diff --git a/tests/unittests/torture_callbacks.c b/tests/unittests/torture_callbacks.c
index f5f7e4da..85f4d1f4 100644
--- a/tests/unittests/torture_callbacks.c
+++ b/tests/unittests/torture_callbacks.c
@@ -138,6 +138,9 @@ static void torture_callbacks_execute_list(void **state){
     };
 
     (void)state;
+
+    assert_non_null(list);
+
     ssh_callbacks_init(&c1);
     ssh_callbacks_init(&c2);
     ssh_callbacks_init(&c3);
@@ -213,6 +216,8 @@ static void torture_callbacks_iterate(void **state){
 
     (void)state; /* unused */
 
+    assert_non_null(list);
+
     ssh_callbacks_init(&c1);
     ssh_callbacks_init(&c2);