From fd2064d0b4cdafc35a3430e7528e32a6abf2d513 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 5 Oct 2012 11:01:55 +0200
Subject: [PATCH] messages: Fix error path of
 ssh_packet_userauth_info_response.

This fixes a memory leak on error.
---
 src/messages.c | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/src/messages.c b/src/messages.c
index c912053f..57ff5b12 100644
--- a/src/messages.c
+++ b/src/messages.c
@@ -716,8 +716,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response){
     if (session->kbdint == NULL) {
       ssh_set_error_oom(session);
 
-      leave_function();
-      return SSH_PACKET_USED;
+      goto error;
     }
   }
 
@@ -729,8 +728,8 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response){
         nanswers, nanswers);
     ssh_kbdint_free(session->kbdint);
     session->kbdint = NULL;
-    leave_function();
-    return SSH_PACKET_USED;
+
+    goto error;
   }
 
   if(nanswers != session->kbdint->nprompts) {
@@ -745,8 +744,8 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response){
     ssh_set_error_oom(session);
     ssh_kbdint_free(session->kbdint);
     session->kbdint = NULL;
-    leave_function();
-    return SSH_PACKET_USED;
+
+    goto error;
   }
   memset(session->kbdint->answers, 0, nanswers * sizeof(char *));
 
@@ -757,8 +756,8 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response){
       session->kbdint->nanswers = i;
       ssh_kbdint_free(session->kbdint);
       session->kbdint = NULL;
-      leave_function();
-      return SSH_PACKET_USED;
+
+      goto error;
     }
     session->kbdint->answers[i] = ssh_string_to_char(tmp);
     ssh_string_free(tmp);
@@ -767,23 +766,20 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response){
       session->kbdint->nanswers = i;
       ssh_kbdint_free(session->kbdint);
       session->kbdint = NULL;
-      leave_function();
-      return SSH_PACKET_USED;
+
+      goto error;
     }
   }
 
-  goto end;
+  ssh_message_queue(session,msg);
+  leave_function();
+  return SSH_PACKET_USED;
 
 error:
   ssh_message_free(msg);
 
   leave_function();
   return SSH_PACKET_USED;
-
-end:
-  ssh_message_queue(session,msg);
-  leave_function();
-  return SSH_PACKET_USED;
 }
 #endif