lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-27 13:21:11 +03:00
Code Activity

sftp: Fix memory leak on realloc failure

Browse Source 
If realloc of sftp->ext->name or sftp->ext->data fails, the memory
previously allocated for the respective member is leaked. Fix this by
storing the return value of realloc() in a temporary variable which only
gets assigned to the respective sftp->ext member on success.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Tobias Klauser
2015-01-13 11:18:41 +01:00
committed by Andreas Schneider
parent 8536cd9808
commit 15d71a8c51
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/sftp.c
View File

@@ -545,6 +545,7 @@ int sftp_init(sftp_session sftp) {
rc = ssh_buffer_unpack(packet->payload, "s", &ext_name); rc = ssh_buffer_unpack(packet->payload, "s", &ext_name);
while (rc == SSH_OK) { while (rc == SSH_OK) {
int count = sftp->ext->count; int count = sftp->ext->count;
char **tmp;
rc = ssh_buffer_unpack(packet->payload, "s", &ext_data); rc = ssh_buffer_unpack(packet->payload, "s", &ext_data);
if (rc == SSH_ERROR) { if (rc == SSH_ERROR) {
@@ -556,23 +557,25 @@ int sftp_init(sftp_session sftp) {
ext_name, ext_data); ext_name, ext_data);
count++; count++;
sftp->ext->name = realloc(sftp->ext->name, count * sizeof(char *)); tmp = realloc(sftp->ext->name, count * sizeof(char *));
if (sftp->ext->name == NULL) { if (tmp == NULL) {
ssh_set_error_oom(sftp->session); ssh_set_error_oom(sftp->session);
SAFE_FREE(ext_name); SAFE_FREE(ext_name);
SAFE_FREE(ext_data); SAFE_FREE(ext_data);
return -1; return -1;
} }
sftp->ext->name[count - 1] = ext_name; tmp[count - 1] = ext_name;
sftp->ext->name = tmp;
sftp->ext->data = realloc(sftp->ext->data, count * sizeof(char *)); tmp = realloc(sftp->ext->data, count * sizeof(char *));
if (sftp->ext->data == NULL) { if (tmp == NULL) {
ssh_set_error_oom(sftp->session); ssh_set_error_oom(sftp->session);
SAFE_FREE(ext_name); SAFE_FREE(ext_name);
SAFE_FREE(ext_data); SAFE_FREE(ext_data);
return -1; return -1;
} }
sftp->ext->data[count - 1] = ext_data; tmp[count - 1] = ext_data;
sftp->ext->data = tmp;
sftp->ext->count = count; sftp->ext->count = count;