WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #806 from LinuxJedi/fs-fixes 

Fix double-free on `wolfSSH_SFTPNAME_readdir`
pull/809/head
Sean Parkinson 2025-05-22 08:12:15 +10:00 committed by GitHub
parent e0a1bdd9c4 e515ea9dc8
commit e32ea9078c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wolfsftp.c
View File

@ -3228,12 +3228,16 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
>= (int)sizeof(r)) { >= (int)sizeof(r)) {
WLOG(WS_LOG_SFTP, "Path length too large"); WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) { if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes"); WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }
@ -3248,6 +3252,8 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) { if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName); WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }