lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-02 01:17:52 +03:00
Code Activity

socket: Fixed use-after-free.

Browse Source 
When s->callbacks->exception() was called in ssh_socket_pollcallback()
we had a use after free bug.
This commit is contained in:
Oliver Stöneberg
2011-05-04 09:20:15 -07:00
committed by Andreas Schneider
parent 32cd45612b
commit 9866763789
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/socket.c
View File

@@ -253,6 +253,9 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
s->callbacks->exception( s->callbacks->exception(
SSH_SOCKET_EXCEPTION_ERROR, SSH_SOCKET_EXCEPTION_ERROR,
s->last_errno,s->callbacks->userdata); s->last_errno,s->callbacks->userdata);
/* p may have been freed, so don't use it
* anymore in this function */
p = NULL;
} }
} }
if(r==0){ if(r==0){
@@ -266,6 +269,9 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
s->callbacks->exception( s->callbacks->exception(
SSH_SOCKET_EXCEPTION_EOF, SSH_SOCKET_EXCEPTION_EOF,
0,s->callbacks->userdata); 0,s->callbacks->userdata);
/* p may have been freed, so don't use it
* anymore in this function */
p = NULL;
} }
} }
if(r>0){ if(r>0){