From 5f4032f831262fbd660abd1980336daca9fc6bfb Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Wed, 20 May 2026 10:03:55 -0700
Subject: [PATCH] wolfssh: config user handling fix

1. Fix where an already allocated config->user is leaked.
2. Copy the argv user name into a heap buffer.

Issue: F-4102
---
 apps/wolfssh/wolfssh.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/apps/wolfssh/wolfssh.c b/apps/wolfssh/wolfssh.c
index 75de6126..d6384815 100644
--- a/apps/wolfssh/wolfssh.c
+++ b/apps/wolfssh/wolfssh.c
@@ -794,7 +794,15 @@ static int config_parse_command_line(struct config* config,
                 break;
 
             case 'l':
-                config->user = myoptarg;
+                if (config->user) {
+                    WFREE(config->user, NULL, 0);
+                    config->user = NULL;
+                }
+                config->user = WSTRDUP(myoptarg, NULL, 0);
+                if (config->user == NULL) {
+                    fprintf(stderr, "Couldn't capture the user name.\n");
+                    exit(EXIT_FAILURE);
+                }
                 break;
 
             case 'N':