summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsemarie@openbsd.org <semarie@openbsd.org>2020-06-26 11:26:01 +0000
committerDamien Miller <djm@mindrot.org>2020-06-27 20:23:27 +1000
commit14beca57ac92d62830c42444c26ba861812dc837 (patch)
treec1b21ebb914ebdd5eb7a976d77e8df2c75a111e3
parent598c3a5e3885080ced0d7c40fde00f1d5cdbb32b (diff)
upstream: backout 1.293 fix kex mem-leak in ssh_packet_close at markus
request the change introduced a NULL deref in sshpkt_vfatal() (uses of ssh->kex after calling ssh_packet_clear_keys()) OpenBSD-Commit-ID: 9c9a6721411461b0b1c28dc00930d7251a798484
-rw-r--r--packet.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/packet.c b/packet.c
index 4780356f..9ffd9f59 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.293 2020/06/24 15:12:09 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.294 2020/06/26 11:26:01 semarie Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -616,8 +616,6 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
state->newkeys[mode] = NULL;
ssh_clear_newkeys(ssh, mode); /* next keys */
}
- kex_free(ssh->kex);
- ssh->kex = NULL;
#ifdef WITH_ZLIB
/* compression state is in shared mem, so we can only release it once */
if (do_close && state->compression_buffer) {