lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-30 13:01:23 +03:00
Code Activity

socket: Fix potential buffer overrun

Browse Source 
If nread is < 0 and no exception callback is set,
the following code block would cause a buffer overrun.

Signed-off-by: Tilo Eckert <tilo.eckert@flam.de>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Tilo Eckert
2018-11-15 10:37:20 +01:00
committed by Andreas Schneider
parent c47cdc0f97
commit 0b9e07fbdc
1 changed files with 2 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/socket.c
View File

@@ -270,12 +270,8 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p,
s->callbacks->exception(SSH_SOCKET_EXCEPTION_ERROR, s->callbacks->exception(SSH_SOCKET_EXCEPTION_ERROR,
s->last_errno, s->last_errno,
s->callbacks->userdata); s->callbacks->userdata);
/* p may have been freed, so don't use it
* anymore in this function */
p = NULL;
return -2;
} }
return -2;
} }
if (nread == 0) { if (nread == 0) {
if (p != NULL) { if (p != NULL) {
@@ -288,12 +284,8 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p,
s->callbacks->exception(SSH_SOCKET_EXCEPTION_EOF, s->callbacks->exception(SSH_SOCKET_EXCEPTION_EOF,
0, 0,
s->callbacks->userdata); s->callbacks->userdata);
/* p may have been freed, so don't use it
* anymore in this function */
p = NULL;
return -2;
} }
return -2;
} }
if (s->session->socket_counter != NULL) { if (s->session->socket_counter != NULL) {