From cbeb2cf566d66adf7e6d9c3ee95c774d0e4e2b4d Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 4 Sep 2018 15:05:48 -0700
Subject: [PATCH] TCP/IP Forwarding 1. Fixed an issue with the FD_SET copy. 2.
 Fixed some memory issues discovered with Valgrind.

---
 examples/wolffwd/wolffwd.c |  2 +-
 src/internal.c             | 15 +++++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/examples/wolffwd/wolffwd.c b/examples/wolffwd/wolffwd.c
index fe03b45d..790bff23 100644
--- a/examples/wolffwd/wolffwd.c
+++ b/examples/wolffwd/wolffwd.c
@@ -327,7 +327,7 @@ THREAD_RETURN WOLFSSH_THREAD wolffwd_worker(void* args)
 
     printf("Entering the run loop...\n");
     while (!done) {
-        FD_COPY(&templateFds, &rxFds);
+        rxFds = templateFds;
         to.tv_sec = 1;
         to.tv_usec = 0;
         ret = select(nFds, &rxFds, NULL, &errFds, &to);
diff --git a/src/internal.c b/src/internal.c
index f2693e22..f6392acc 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1033,14 +1033,18 @@ int ChannelUpdateForward(WOLFSSH_CHANNEL* channel,
     int ret = WS_SUCCESS;
     char* hostCopy = NULL;
     char* originCopy = NULL;
+    word32 hostSz;
+    word32 originSz;
 
     if (channel == NULL || host == NULL || origin == NULL)
         ret = WS_BAD_ARGUMENT;
     else {
         void* heap = channel->ssh->ctx->heap;
 
-        hostCopy = (char*)WMALLOC(WSTRLEN(host) + 1, heap, DYNTYPE_STRING);
-        originCopy = (char*)WMALLOC(WSTRLEN(origin) + 1, heap, DYNTYPE_STRING);
+        hostSz = (word32)WSTRLEN(host) + 1;
+        originSz = (word32)WSTRLEN(origin) + 1;
+        hostCopy = (char*)WMALLOC(hostSz, heap, DYNTYPE_STRING);
+        originCopy = (char*)WMALLOC(originSz, heap, DYNTYPE_STRING);
         if (hostCopy == NULL || originCopy == NULL) {
             WFREE(hostCopy, heap, DYNTYPE_STRING);
             WFREE(originCopy, heap, DYNTYPE_STRING);
@@ -1049,6 +1053,8 @@ int ChannelUpdateForward(WOLFSSH_CHANNEL* channel,
     }
 
     if (ret == WS_SUCCESS) {
+        WSTRNCPY(hostCopy, host, hostSz);
+        WSTRNCPY(originCopy, origin, originSz);
         channel->host = hostCopy;
         channel->hostPort = hostPort;
         channel->origin = originCopy;
@@ -6719,7 +6725,8 @@ int SendChannelOpenForward(WOLFSSH* ssh, WOLFSSH_CHANNEL* channel)
 
     WLOG(WS_LOG_DEBUG, "Entering SendChannelOpenForward()");
 
-    if (ssh == NULL || channel->host == NULL || channel->origin == NULL)
+    if (ssh == NULL || channel == NULL ||
+            channel->host == NULL || channel->origin == NULL)
         ret = WS_BAD_ARGUMENT;
 
     if (ret == WS_SUCCESS) {
@@ -6739,7 +6746,7 @@ int SendChannelOpenForward(WOLFSSH* ssh, WOLFSSH_CHANNEL* channel)
         idx += hostSz;
         c32toa(channel->hostPort, forwardData + idx);
         idx += UINT32_SZ;
-        c32toa(originSz, forwardData);
+        c32toa(originSz, forwardData + idx);
         idx += LENGTH_SZ;
         WMEMCPY(forwardData + idx, channel->origin, originSz);
         idx += originSz;