Artyom V. Poptsov 1ab2340644 channels: Fix segfaults when the channel data is freed ...

Calling some channel procedures on a freed channel is always resulting
in segmentation fault errors.  The reason is that when a channel is
freed with 'ssh_channel_do_free' procedure, its 'session' field is set
to NULL; then when a channel procedure tries to access any field of
'channel->session' structure it is effectively dereferencing a NULL
pointer.

The change fixes that behavior by adding a check which ensures that a
channel state is not SSH_CHANNEL_FLAG_FREED_LOCAL before accessing its
parent session.

Also the test suite is updated to check for the fixed errors, and the
Doxygen documentation updated accordingly.

There was a bug introduced in b0fb7d15: 'ssh_channel_poll',
'ssh_channel_poll_timeout' and 'ssh_channel_get_exit_status' would
compare the channel state to the 'SSH_CHANNEL_FLAG_FREED_LOCAL'
constant to check if the channel is alive.  But the procedures must
check the channel flags for the presence of
'SSH_CHANNEL_FLAG_FREED_LOCAL' bits instead.  This change fixes the
bug.

Signed-off-by: Artyom V. Poptsov <poptsov.artyom@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>

2021-09-15 11:04:45 +02:00

12 KiB

Raw Blame History

View Raw