# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1520432076 -28800
# Node ID e37f98ea4f24ee895ce2f9b03c0a455d06839c0a
# Parent  252b406d0e9add92160cd1e368a216eca72efa7a
fix leak in option handling

diff -r 252b406d0e9a -r e37f98ea4f24 svr-authpubkeyoptions.c
--- a/svr-authpubkeyoptions.c	Tue Mar 06 22:18:20 2018 +0800
+++ b/svr-authpubkeyoptions.c	Wed Mar 07 22:14:36 2018 +0800
@@ -168,6 +168,12 @@
 		if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) {
 			int escaped = 0;
 			const unsigned char* command_start = buf_getptr(options_buf, 0);
+
+			if (ses.authstate.pubkey_options->forced_command) {
+				/* multiple command= options */
+				goto bad_option;
+			}
+
 			while (options_buf->pos < options_buf->len) {
 				const char c = buf_getbyte(options_buf);
 				if (!escaped && c == '"') {