WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

sftp: NULL fName after free in all readdir variants 

- Apply the prior FATFS fix across Nucleus, MQX, Windows,
  Zephyr, Harmony, and user-filesystem readdir paths.
- Prevents double-free crash when SFTPNAME_free runs on a
  name struct after readdir returns an error.
pull/979/head
John Safranek 2026-05-13 10:21:23 -07:00 committed by Paul Adelsbach
parent 0169eb4544
commit 4b948e68cf
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/wolfsftp.c
View File

@ -2820,6 +2820,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -2889,6 +2890,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
>= (int)sizeof(r)) {
WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
}
@ -2896,6 +2898,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (out->fSz + 1 > (sizeof r)) {
WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
WSTRNCPY(r, out->fName, sizeof(r));
@ -2904,6 +2907,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -2930,6 +2934,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -2987,12 +2992,14 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
>= (int)sizeof(r)) {
WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -3007,6 +3014,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -3084,6 +3092,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
buf = (char*)WMALLOC(bufSz, out->heap, DYNTYPE_SFTP);
if (buf == NULL) {
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_MEMORY_E;
}
@ -3105,6 +3114,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -3221,11 +3231,13 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
>= (int)sizeof(r)) {
WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
return WS_FATAL_ERROR;
}
@ -3241,6 +3253,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
@ -3298,6 +3311,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
return WS_FATAL_ERROR;
}
return WS_SUCCESS;