diff options
| author | Matt Johnston <matt@ucc.asn.au> | 2011-12-04 05:31:25 +0800 |
|---|---|---|
| committer | Matt Johnston <matt@ucc.asn.au> | 2011-12-04 05:31:25 +0800 |
| commit | aec23e5f791b78ed195358057f07f3050ab5bf94 (patch) | |
| tree | 811346f9bbbcf950da16f1d6b992bf88f11aef6f /svr-chansession.c | |
| parent | 52a466b8afa32a1355dcbc90936eedcf5d740b1d (diff) | |
- Fix use-after-free if multiple command requests were sent. Move
the original_command into chansess struct since that makes more sense
Diffstat (limited to 'svr-chansession.c')
| -rw-r--r-- | svr-chansession.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/svr-chansession.c b/svr-chansession.c index 0b3e833..53790d1 100644 --- a/svr-chansession.c +++ b/svr-chansession.c @@ -217,6 +217,8 @@ static int newchansess(struct Channel *channel) { struct ChanSess *chansess; + TRACE(("new chansess %p", channel)) + dropbear_assert(channel->typedata == NULL); chansess = (struct ChanSess*)m_malloc(sizeof(struct ChanSess)); @@ -279,6 +281,10 @@ static void closechansess(struct Channel *channel) { m_free(chansess->cmd); m_free(chansess->term); +#ifdef ENABLE_SVR_PUBKEY_OPTIONS + m_free(chansess->original_command); +#endif + if (chansess->tty) { /* write the utmp/wtmp login record */ li = chansess_login_alloc(chansess); @@ -924,10 +930,8 @@ static void execchild(void *user_data) { } #ifdef ENABLE_SVR_PUBKEY_OPTIONS - if (ses.authstate.pubkey_options && - ses.authstate.pubkey_options->original_command) { - addnewvar("SSH_ORIGINAL_COMMAND", - ses.authstate.pubkey_options->original_command); + if (chansess->original_command) { + addnewvar("SSH_ORIGINAL_COMMAND", chansess->original_command); } #endif |