diff options
| -rw-r--r-- | fuzzer-kexdh.c | 6 | ||||
| -rw-r--r-- | fuzzer-kexecdh.c | 6 |
2 files changed, 10 insertions, 2 deletions
diff --git a/fuzzer-kexdh.c b/fuzzer-kexdh.c index f7abea2..224ff58 100644 --- a/fuzzer-kexdh.c +++ b/fuzzer-kexdh.c @@ -57,10 +57,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey); - /* kexhashbuf is freed in kexdh_comb_key */ + mp_clear(ses.dh_K); m_free(ses.dh_K); mp_clear(&dh_e); + buf_free(ses.hash); + buf_free(ses.session_id); + /* kexhashbuf is freed in kexdh_comb_key */ + m_malloc_free_epoch(1, 0); } else { m_malloc_free_epoch(1, 1); diff --git a/fuzzer-kexecdh.c b/fuzzer-kexecdh.c index 693aecb..c3a450a 100644 --- a/fuzzer-kexecdh.c +++ b/fuzzer-kexecdh.c @@ -63,10 +63,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); kexecdh_comb_key(ecdh_param, ecdh_qs, svr_opts.hostkey); - /* kexhashbuf is freed in kexdh_comb_key */ + mp_clear(ses.dh_K); m_free(ses.dh_K); buf_free(ecdh_qs); + buf_free(ses.hash); + buf_free(ses.session_id); + /* kexhashbuf is freed in kexdh_comb_key */ + m_malloc_free_epoch(1, 0); } else { m_malloc_free_epoch(1, 1); |