lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-14 04:18:54 +03:00
Code Activity

server: Don't leak memory on calling ssh_string_from_char().

Browse Source 
Also check the return values.

Found by Coverity.
This commit is contained in:
Andreas Schneider
2012-10-08 20:39:56 +02:00
parent 7254390ac2
commit 4e7736444f
1 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
src/server.c
View File

@@ -699,6 +699,10 @@ int ssh_message_service_reply_success(ssh_message msg) {
return -1; return -1;
} }
service=ssh_string_from_char(msg->service_request.service); service=ssh_string_from_char(msg->service_request.service);
if (service == NULL) {
return -1;
}
if (buffer_add_ssh_string(session->out_buffer, service) < 0) { if (buffer_add_ssh_string(session->out_buffer, service) < 0) {
ssh_string_free(service); ssh_string_free(service);
return -1; return -1;
@@ -866,24 +870,39 @@ int ssh_message_auth_interactive_request(ssh_message msg, const char *name,
/* name */ /* name */
tmp = ssh_string_from_char(name); tmp = ssh_string_from_char(name);
if (buffer_add_ssh_string(msg->session->out_buffer, tmp) < 0) { if (tmp == NULL) {
return SSH_ERROR;
}
r = buffer_add_ssh_string(msg->session->out_buffer, tmp);
ssh_string_free(tmp);
if (r < 0) {
return SSH_ERROR; return SSH_ERROR;
} }
ssh_string_free(tmp); tmp = NULL;
/* instruction */ /* instruction */
tmp = ssh_string_from_char(instruction); tmp = ssh_string_from_char(instruction);
if (buffer_add_ssh_string(msg->session->out_buffer, tmp) < 0) { if (tmp == NULL) {
return SSH_ERROR;
}
r = buffer_add_ssh_string(msg->session->out_buffer, tmp);
ssh_string_free(tmp);
if (r < 0) {
return SSH_ERROR; return SSH_ERROR;
} }
ssh_string_free(tmp); tmp = NULL;
/* language tag */ /* language tag */
tmp = ssh_string_from_char(""); tmp = ssh_string_from_char("");
if (buffer_add_ssh_string(msg->session->out_buffer, tmp) < 0) { if (tmp == NULL) {
return SSH_ERROR;
}
r = buffer_add_ssh_string(msg->session->out_buffer, tmp);
ssh_string_free(tmp);
if (r < 0) {
return SSH_ERROR; return SSH_ERROR;
} }
ssh_string_free(tmp); tmp = NULL;
/* num prompts */ /* num prompts */
if (buffer_add_u32(msg->session->out_buffer, ntohl(num_prompts)) < 0) { if (buffer_add_u32(msg->session->out_buffer, ntohl(num_prompts)) < 0) {
@@ -893,10 +912,15 @@ int ssh_message_auth_interactive_request(ssh_message msg, const char *name,
for(i = 0; i < num_prompts; i++) { for(i = 0; i < num_prompts; i++) {
/* prompt[i] */ /* prompt[i] */
tmp = ssh_string_from_char(prompts[i]); tmp = ssh_string_from_char(prompts[i]);
if (buffer_add_ssh_string(msg->session->out_buffer, tmp) < 0) { if (tmp == NULL) {
return SSH_ERROR;
}
r = buffer_add_ssh_string(msg->session->out_buffer, tmp);
ssh_string_free(tmp);
if (r < 0) {
goto error; goto error;
} }
ssh_string_free(tmp); tmp = NULL;
/* echo[i] */ /* echo[i] */
if (buffer_add_u8(msg->session->out_buffer, echo[i]) < 0) { if (buffer_add_u8(msg->session->out_buffer, echo[i]) < 0) {