mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
ff501d6346
When sending the open confirmation in `packet_x11_open()` or `packet_queue_listener()` returns EAGAIN, the resumed call loses the channel it just allocated: the x11 path never saves it in `x11open_state->channel`, so it links a NULL channel and crashes, and the listener path clears `listen_state->channel` on every pass, so the server gets a confirmation for a channel that is never queued and leaks. This keeps the pointer in the state struct the same way `packet_authagent_open()` already does, which I checked with a send callback that returns EAGAIN once (ASan SEGV in `ssh2_list_add()` before, and the channel reaches the x11 callback and the accept queue after). I also looked at #1427, which touched the same EAGAIN return, and this is the gap behind the question raised there about the channel still being usable when the function is re-entered. Reported-by: Yin Luming Ref: https://github.com/LuMingYinDetect/libssh_defects/blob/main/libssh_1.png Fixes #1427 Closes #2656
libssh2 - SSH2 library
libssh2 is a library implementing the SSH2 protocol, available under the revised BSD license.
Installation instructions: