diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2015-08-19 23:18:26 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2015-08-20 13:07:41 +1000 |
| commit | 45b0eb752c94954a6de046bfaaf129e518ad4b5b (patch) | |
| tree | afb533e748e80b20d87c9022f15809a7bb758b57 | |
| parent | c837643b93509a3ef538cb6624b678c5fe32ff79 (diff) | |
| download | openssh-git-45b0eb752c94954a6de046bfaaf129e518ad4b5b.tar.gz | |
upstream commit
fix free() of uninitialised pointer reported by Mateusz
Kocielski; ok markus@
Upstream-ID: 519552b050618501a06b7b023de5cb104e2c5663
| -rw-r--r-- | mux.c | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: mux.c,v 1.53 2015/05/01 04:03:20 djm Exp $ */ +/* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */ /* * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> * @@ -665,6 +665,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r) u_int lport, cport; int i, ret = 0, freefwd = 1; + memset(&fwd, 0, sizeof(fwd)); + /* XXX - lport/cport check redundant */ if (buffer_get_int_ret(&ftype, m) != 0 || (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || @@ -832,6 +834,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r) int i, ret = 0; u_int lport, cport; + memset(&fwd, 0, sizeof(fwd)); + if (buffer_get_int_ret(&ftype, m) != 0 || (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || buffer_get_int_ret(&lport, m) != 0 || |