WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #806 from LinuxJedi/fs-fixes 

Fix double-free on `wolfSSH_SFTPNAME_readdir`
pull/809/head
Sean Parkinson 2025-05-22 08:12:15 +10:00 committed by GitHub
parent e0a1bdd9c4 e515ea9dc8
commit e32ea9078c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/wolfsftp.c
View File

@ -3228,12 +3228,16 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
>= (int)sizeof(r)) { >= (int)sizeof(r)) {
WLOG(WS_LOG_SFTP, "Path length too large"); WLOG(WS_LOG_SFTP, "Path length too large");
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) { if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes"); WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }
@ -3248,6 +3252,8 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
if (SFTP_CreateLongName(out) != WS_SUCCESS) { if (SFTP_CreateLongName(out) != WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName); WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
WFREE(out->fName, out->heap, DYNTYPE_SFTP); WFREE(out->fName, out->heap, DYNTYPE_SFTP);
out->fName = NULL;
out->fSz = 0;
return WS_FATAL_ERROR; return WS_FATAL_ERROR;
} }
@ -3976,7 +3982,7 @@ int wolfSSH_SFTP_RecvClose(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
if (sz == sizeof(WFD)) { if (sz == sizeof(WFD)) {
WMEMSET((byte*)&fd, 0, sizeof(WFD)); WMEMSET((byte*)&fd, 0, sizeof(WFD));
WMEMCPY((byte*)&fd, data + idx, sz); WMEMCPY((byte*)&fd, data + idx, sz);
#ifdef MICROCHIP_MPLAB_HARMONY #ifdef MICROCHIP_MPLAB_HARMONY
ret = WFCLOSE(ssh->fs, &fd); ret = WFCLOSE(ssh->fs, &fd);
#else #else
@ -5003,7 +5009,7 @@ int SFTP_GetAttributes(void* fs, const char* fileName, WS_SFTP_FILEATRB* atr,
{ {
WOLFSSH_UNUSED(heap); WOLFSSH_UNUSED(heap);
WOLFSSH_UNUSED(fs); WOLFSSH_UNUSED(fs);
return SFTP_GetAttributesHelper(atr, fileName); return SFTP_GetAttributesHelper(atr, fileName);
} }
@ -5028,7 +5034,7 @@ int SFTP_GetAttributes_Handle(WOLFSSH* ssh, byte* handle, int handleSz,
WLOG(WS_LOG_SFTP, "Unknown handle"); WLOG(WS_LOG_SFTP, "Unknown handle");
return WS_BAD_FILE_E; return WS_BAD_FILE_E;
} }
return SFTP_GetAttributesHelper(atr, cur->name); return SFTP_GetAttributesHelper(atr, cur->name);
} }
@ -8844,7 +8850,7 @@ int wolfSSH_SFTP_Get(WOLFSSH* ssh, char* from,
if (state->gOfst[0] > 0 || state->gOfst[1] > 0) if (state->gOfst[0] > 0 || state->gOfst[1] > 0)
ret = WFOPEN(ssh->fs, &state->fl, to, WOLFSSH_O_APPEND); ret = WFOPEN(ssh->fs, &state->fl, to, WOLFSSH_O_APPEND);
else else
ret = WFOPEN(ssh->fs, &state->fl, to, WOLFSSH_O_WRONLY); ret = WFOPEN(ssh->fs, &state->fl, to, WOLFSSH_O_WRONLY);
#elif defined(USE_WINDOWS_API) #elif defined(USE_WINDOWS_API)
{ {
DWORD desiredAccess = GENERIC_WRITE; DWORD desiredAccess = GENERIC_WRITE;