romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 08:37:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

libssh: return out of memory correctly if aprintf fails

Browse source 
The code called set sshc->nextstate and returned SSH_OK without setting
sshc->actualcode to an error code.

Reported in Joshua's sarif data

Closes #18637
This commit is contained in:
Daniel Stenberg 2025-09-20 14:51:01 +02:00
parent d27d9c7ef1
commit e2d3b83244
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 7 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

15
lib/vssh/libssh.c
View file

@ -765,7 +765,7 @@ static int myssh_in_SFTP_QUOTE_STATVFS(struct Curl_easy *data,
#else
#define CURL_LIBSSH_VFS_SIZE_MASK PRIu64
#endif
CURLcode result;
CURLcode result = CURLE_OK;
char *tmp = aprintf("statvfs:\n"
"f_bsize: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
"f_frsize: %" CURL_LIBSSH_VFS_SIZE_MASK "\n"
@ -786,14 +786,13 @@ static int myssh_in_SFTP_QUOTE_STATVFS(struct Curl_easy *data,
statvfs->f_namemax);
sftp_statvfs_free(statvfs);
if(!tmp) {
myssh_to(data, sshc, SSH_SFTP_CLOSE);
sshc->nextstate = SSH_NO_STATE;
return SSH_OK;
}
if(!tmp)
result = CURLE_OUT_OF_MEMORY;
result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
free(tmp);
if(!result) {
result = Curl_client_write(data, CLIENTWRITE_HEADER, tmp, strlen(tmp));
free(tmp);
}
if(result) {
myssh_to(data, sshc, SSH_SFTP_CLOSE);
sshc->nextstate = SSH_NO_STATE;