Vic Lee a écrit : > Hi, > > I recently encounter some occasional crashes when trying to use channel > request stuff. It turned out that in function > handle_channel_request_open(), a variable 'type' is freed but then used > in later codes, which causes unexpected result, sometimes double-freed > and crash, but if you are lucky sometimes things won't happen. > > I will consider this bug a very critical one because this will make the > function handle_channel_request_open() very unstable, affecting both > server side (all channel requests) and client side (x11 and > forward-listen requests) > > I found this in v0-4 branch, please help me to check master as well... > > Thanks, > > Vic > Thanks for your patch.
I will check on the master branch. I remember having reworked that code (it's funny I did not see the problem), maybe I have corrected it. Moreover, a double free is a security problem. If it is easy to reproduce, we may have to do a security release. Aris
