lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-29 01:03:57 +03:00
Code Activity

buffer: Do cleanup if ssh_buffer_unpack() fails in the first loop

Browse Source 
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Andreas Schneider
2018-09-19 10:11:07 +02:00
parent 07f7fa7806
commit 90373d8394
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/buffer.c
View File

@@ -1109,7 +1109,8 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
/* Invalid number of arguments passed */ /* Invalid number of arguments passed */
if (argc != -1 && count > argc) { if (argc != -1 && count > argc) {
va_end(ap_copy); va_end(ap_copy);
return SSH_ERROR; rc = SSH_ERROR;
goto cleanup;
} }
switch (*p) { switch (*p) {
@@ -1221,6 +1222,7 @@ int ssh_buffer_unpack_va(struct ssh_buffer_struct *buffer,
rc = SSH_ERROR; rc = SSH_ERROR;
} }
cleanup:
if (rc != SSH_ERROR){ if (rc != SSH_ERROR){
/* Check if our canary is intact, if not something really bad happened */ /* Check if our canary is intact, if not something really bad happened */
uint32_t canary = va_arg(ap, uint32_t); uint32_t canary = va_arg(ap, uint32_t);