From aec23e5f791b78ed195358057f07f3050ab5bf94 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Sun, 4 Dec 2011 05:31:25 +0800 Subject: - Fix use-after-free if multiple command requests were sent. Move the original_command into chansess struct since that makes more sense --- svr-authpubkeyoptions.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'svr-authpubkeyoptions.c') diff --git a/svr-authpubkeyoptions.c b/svr-authpubkeyoptions.c index fd87703..4490b58 100644 --- a/svr-authpubkeyoptions.c +++ b/svr-authpubkeyoptions.c @@ -92,14 +92,15 @@ int svr_pubkey_allows_pty() { * by any 'command' public key option. */ void svr_pubkey_set_forced_command(struct ChanSess *chansess) { if (ses.authstate.pubkey_options) { - ses.authstate.pubkey_options->original_command = chansess->cmd; - if (!chansess->cmd) - { - ses.authstate.pubkey_options->original_command = m_strdup(""); + if (chansess->cmd) { + /* original_command takes ownership */ + chansess->original_command = chansess->cmd; + } else { + chansess->original_command = m_strdup(""); } - chansess->cmd = ses.authstate.pubkey_options->forced_command; + chansess->cmd = m_strdup(ses.authstate.pubkey_options->forced_command); #ifdef LOG_COMMANDS - dropbear_log(LOG_INFO, "Command forced to '%s'", ses.authstate.pubkey_options->original_command); + dropbear_log(LOG_INFO, "Command forced to '%s'", chansess->original_command); #endif } } -- cgit v1.2.3