From 0a17ea04dcc2b10b6817ae19d690e15f66c83624 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 3 Aug 2026 20:13:51 +0200 Subject: [PATCH] packet: fix memleak on receiving multiple `exit-signal` packets Reported-by: afldl on github Fixes GHSA-53q9-wmqr-fh7c Follow-up to 6140ec2de332ebdb618bdccf8c3c28b97eb6bde1 Closes #2504 --- src/packet.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/packet.c b/src/packet.c index 1b98cebd..e040ba81 100644 --- a/src/packet.c +++ b/src/packet.c @@ -1136,9 +1136,10 @@ ssh2_packet_add_jump_point1: rc = ssh2_err(session, LIBSSH2_ERROR_PROTO, "signal name out of bounds"); else if(sig_len > 0) { + if(channelp->exit_signal) + SSH2_FREE(session, channelp->exit_signal); channelp->exit_signal = SSH2_ALLOC(session, sig_len + 1); - if(channelp->exit_signal) { memcpy(channelp->exit_signal, sig_name, sig_len); @@ -1155,8 +1156,8 @@ ssh2_packet_add_jump_point1: rc = ssh2_err(session, LIBSSH2_ERROR_ALLOC, "exit signal alloc error"); } - else - channelp->exit_signal = NULL; + else if(channelp->exit_signal) + SSH2_SAFEFREE(session, channelp->exit_signal); } }