From 87a0fb354f2b8a3bd930d23964281f3e88ce8bc4 Mon Sep 17 00:00:00 2001 From: syed abdul khaliq Date: Wed, 14 Oct 2026 16:59:41 +0530 Subject: [PATCH] userauth: free list packet on oversize methods in `userauth_list()` error path userauth_list() keeps the server's USERAUTH_FAILURE/BANNER response in session->userauth_list_data. Five of its error returns free that buffer before returning NULL (the data_len < 5 check, the three banner checks, and the SUCCESS case), but the oversize-methods check does not. When a server sends a methods length field that is >= the bytes actually present, the function returns at the LIBSSH2_ERROR_OUT_OF_BOUNDARY branch with the response packet still allocated, so it leaks (the pointer is only reclaimed at session teardown, or overwritten and leaked again if the caller retries). The patch adds the SSH2_SAFEFREE already used by the adjacent data_len < 5 branch, so the last error path frees what the function owns. Trigger is a server response whose methods length field exceeds the packet body. Closes #2667 --- src/userauth.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/userauth.c b/src/userauth.c index 7bdc5775..51463e10 100644 --- a/src/userauth.c +++ b/src/userauth.c @@ -214,6 +214,7 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username, methods_len = ssh2_ntohu32(session->userauth_list_data + 1); if(methods_len >= session->userauth_list_data_len - 5) { + SSH2_SAFEFREE(session, session->userauth_list_data); ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY, "Unexpected userauth list size"); return NULL;