Mercurial > dropbear
diff svr-authpubkeyoptions.c @ 654:818108bf7749
- Fix use-after-free if multiple command requests were sent. Move
the original_command into chansess struct since that makes more sense
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sun, 04 Dec 2011 05:31:25 +0800 |
| parents | a98a2138364a |
| children | 405418f7dc5e |
line wrap: on
line diff
--- a/svr-authpubkeyoptions.c Sun Dec 04 05:27:57 2011 +0800 +++ b/svr-authpubkeyoptions.c Sun Dec 04 05:31:25 2011 +0800 @@ -92,14 +92,15 @@ * by any 'command' public key option. */ void svr_pubkey_set_forced_command(struct ChanSess *chansess) { if (ses.authstate.pubkey_options) { - ses.authstate.pubkey_options->original_command = chansess->cmd; - if (!chansess->cmd) - { - ses.authstate.pubkey_options->original_command = m_strdup(""); + if (chansess->cmd) { + /* original_command takes ownership */ + chansess->original_command = chansess->cmd; + } else { + chansess->original_command = m_strdup(""); } - chansess->cmd = ses.authstate.pubkey_options->forced_command; + chansess->cmd = m_strdup(ses.authstate.pubkey_options->forced_command); #ifdef LOG_COMMANDS - dropbear_log(LOG_INFO, "Command forced to '%s'", ses.authstate.pubkey_options->original_command); + dropbear_log(LOG_INFO, "Command forced to '%s'", chansess->original_command); #endif } }