Hi, I recently encounter some occasional crashes when trying to use channel request stuff. It turned out that in function handle_channel_request_open(), a variable 'type' is freed but then used in later codes, which causes unexpected result, sometimes double-freed and crash, but if you are lucky sometimes things won't happen.
I will consider this bug a very critical one because this will make the function handle_channel_request_open() very unstable, affecting both server side (all channel requests) and client side (x11 and forward-listen requests) I found this in v0-4 branch, please help me to check master as well... Thanks, Vic
>From 71fd5b4d079c044e48c3050f0952262e4cd7ef1b Mon Sep 17 00:00:00 2001 From: Vic Lee <[email protected]> Date: Wed, 20 Jan 2010 00:13:52 +0800 Subject: [PATCH] In handle_channel_request_open(), variable type is freed too early and cause memory corruptions. Signed-off-by: Vic Lee <[email protected]> --- libssh/messages.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/libssh/messages.c b/libssh/messages.c index 2b60dfd..fc1624c 100644 --- a/libssh/messages.c +++ b/libssh/messages.c @@ -319,7 +319,6 @@ static ssh_message handle_channel_request_open(ssh_session session) { ssh_log(session, SSH_LOG_PACKET, "Clients wants to open a %s channel", type_c); - string_free(type); buffer_get_u32(session->in_buffer, &sender); buffer_get_u32(session->in_buffer, &window); @@ -331,6 +330,7 @@ static ssh_message handle_channel_request_open(ssh_session session) { if (strcmp(type_c,"session") == 0) { msg->channel_request_open.type = SSH_CHANNEL_SESSION; + string_free(type); SAFE_FREE(type_c); leave_function(); return msg; @@ -370,6 +370,7 @@ static ssh_message handle_channel_request_open(ssh_session session) { msg->channel_request_open.originator_port = ntohl(originator_port); msg->channel_request_open.type = SSH_CHANNEL_DIRECT_TCPIP; + string_free(type); SAFE_FREE(type_c); leave_function(); return msg; @@ -409,6 +410,7 @@ static ssh_message handle_channel_request_open(ssh_session session) { msg->channel_request_open.originator_port = ntohl(originator_port); msg->channel_request_open.type = SSH_CHANNEL_FORWARDED_TCPIP; + string_free(type); SAFE_FREE(type_c); leave_function(); return msg; @@ -432,12 +434,14 @@ static ssh_message handle_channel_request_open(ssh_session session) { msg->channel_request_open.originator_port = ntohl(originator_port); msg->channel_request_open.type = SSH_CHANNEL_X11; + string_free(type); SAFE_FREE(type_c); leave_function(); return msg; } msg->channel_request_open.type = SSH_CHANNEL_UNKNOWN; + string_free(type); SAFE_FREE(type_c); leave_function(); -- 1.6.5
