mirror of
				https://git.libssh.org/projects/libssh.git
				synced 2025-11-03 21:53:14 +03:00 
			
		
		
		
	dh: Don't leak 'f' on error.
Found by Coverity.
This commit is contained in:
		
							
								
								
									
										11
									
								
								src/dh.c
									
									
									
									
									
								
							
							
						
						
									
										11
									
								
								src/dh.c
									
									
									
									
									
								
							@@ -593,7 +593,7 @@ int ssh_client_dh_init(ssh_session session){
 | 
				
			|||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
int ssh_client_dh_reply(ssh_session session, ssh_buffer packet){
 | 
					int ssh_client_dh_reply(ssh_session session, ssh_buffer packet){
 | 
				
			||||||
  ssh_string f = NULL;
 | 
					  ssh_string f;
 | 
				
			||||||
  ssh_string pubkey = NULL;
 | 
					  ssh_string pubkey = NULL;
 | 
				
			||||||
  ssh_string signature = NULL;
 | 
					  ssh_string signature = NULL;
 | 
				
			||||||
  int rc;
 | 
					  int rc;
 | 
				
			||||||
@@ -609,13 +609,14 @@ int ssh_client_dh_reply(ssh_session session, ssh_buffer packet){
 | 
				
			|||||||
    ssh_set_error(session,SSH_FATAL, "No F number in packet");
 | 
					    ssh_set_error(session,SSH_FATAL, "No F number in packet");
 | 
				
			||||||
    goto error;
 | 
					    goto error;
 | 
				
			||||||
  }
 | 
					  }
 | 
				
			||||||
  if (dh_import_f(session, f) < 0) {
 | 
					  rc = dh_import_f(session, f);
 | 
				
			||||||
 | 
					  ssh_string_burn(f);
 | 
				
			||||||
 | 
					  ssh_string_free(f);
 | 
				
			||||||
 | 
					  if (rc < 0) {
 | 
				
			||||||
    ssh_set_error(session, SSH_FATAL, "Cannot import f number");
 | 
					    ssh_set_error(session, SSH_FATAL, "Cannot import f number");
 | 
				
			||||||
    goto error;
 | 
					    goto error;
 | 
				
			||||||
  }
 | 
					  }
 | 
				
			||||||
  ssh_string_burn(f);
 | 
					
 | 
				
			||||||
  ssh_string_free(f);
 | 
					 | 
				
			||||||
  f=NULL;
 | 
					 | 
				
			||||||
  signature = buffer_get_ssh_string(packet);
 | 
					  signature = buffer_get_ssh_string(packet);
 | 
				
			||||||
  if (signature == NULL) {
 | 
					  if (signature == NULL) {
 | 
				
			||||||
    ssh_set_error(session, SSH_FATAL, "No signature in packet");
 | 
					    ssh_set_error(session, SSH_FATAL, "No signature in packet");
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user