| Summary: | possible use after free | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Loganaden Velvindron <loganaden> | ||||
| Component: | sshd | Assignee: | Assigned to nobody <unassigned-bugs> | ||||
| Status: | CLOSED FIXED | ||||||
| Severity: | normal | CC: | djm | ||||
| Priority: | P5 | ||||||
| Version: | -current | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 2130 | ||||||
| Attachments: |
|
||||||
applied - thanks. Set all RESOLVED bugs to CLOSED with release of OpenSSH 7.1 |
Created attachment 2377 [details] use_after_free fix blob() might be freed on subsequent loop iterations. if ((nkeys = pkcs11_add_provider(name, pin, &keys)) > 0) { buffer_put_char(&msg, SSH2_AGENT_IDENTITIES_ANSWER); buffer_put_int(&msg, nkeys); for (i = 0; i < nkeys; i++) { key_to_blob(keys[i], &blob, &blen) buffer_put_string(&msg, blob, blen); buffer_put_cstring(&msg, name); free(blob); add_key(keys[i], name);