mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
87a0fb354f
userauth_list() keeps the server's USERAUTH_FAILURE/BANNER response in session->userauth_list_data. Five of its error returns free that buffer before returning NULL (the data_len < 5 check, the three banner checks, and the SUCCESS case), but the oversize-methods check does not. When a server sends a methods length field that is >= the bytes actually present, the function returns at the LIBSSH2_ERROR_OUT_OF_BOUNDARY branch with the response packet still allocated, so it leaks (the pointer is only reclaimed at session teardown, or overwritten and leaked again if the caller retries). The patch adds the SSH2_SAFEFREE already used by the adjacent data_len < 5 branch, so the last error path frees what the function owns. Trigger is a server response whose methods length field exceeds the packet body. Closes #2667
libssh2 - SSH2 library
libssh2 is a library implementing the SSH2 protocol, available under the revised BSD license.
Installation instructions: