mirror of
https://git.libssh.org/projects/libssh.git
synced 2025-11-29 01:03:57 +03:00
options: Fix a free crash bug if we parse unknown options.
Thanks to Yong Chuan Koh, X-Force Research <kohyc@sg.ibm.com>
This commit is contained in:
@@ -953,12 +953,6 @@ int ssh_options_getopt(ssh_session session, int *argcptr, char **argv) {
|
||||
int saveoptind = optind; /* need to save 'em */
|
||||
int saveopterr = opterr;
|
||||
|
||||
save = malloc(argc * sizeof(char *));
|
||||
if (save == NULL) {
|
||||
ssh_set_error_oom(session);
|
||||
return -1;
|
||||
}
|
||||
|
||||
opterr = 0; /* shut up getopt */
|
||||
while(cont && ((i = getopt(argc, argv, "c:i:Cl:p:vb:rd12")) != -1)) {
|
||||
switch(i) {
|
||||
@@ -996,8 +990,16 @@ int ssh_options_getopt(ssh_session session, int *argcptr, char **argv) {
|
||||
break;
|
||||
default:
|
||||
{
|
||||
char **tmp;
|
||||
char opt[3]="- ";
|
||||
opt[1] = optopt;
|
||||
tmp = realloc(save, (current + 1) * sizeof(char*));
|
||||
if (tmp == NULL) {
|
||||
SAFE_FREE(save);
|
||||
ssh_set_error_oom(session);
|
||||
return -1;
|
||||
}
|
||||
save = tmp;
|
||||
save[current] = strdup(opt);
|
||||
if (save[current] == NULL) {
|
||||
SAFE_FREE(save);
|
||||
|
||||
Reference in New Issue
Block a user