openssh unix dev - Aug 2003 - [PATCH] memory leaked leaving scope

Index: openssh/deattack.c
==================================================================RCS file:
/cvs/openssh/deattack.c,v
retrieving revision 1.15
diff -u -r1.15 deattack.c
--- openssh/deattack.c	5 Mar 2002 01:53:05 -0000	1.15
+++ openssh/deattack.c	22 Aug 2003 05:34:05 -0000
@@ -112,20 +112,26 @@
	if (len <= HASH_MINBLOCKS) {
		for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
			if (IV && (!CMP(c, IV))) {
-				if ((check_crc(c, buf, len, IV)))
+				if ((check_crc(c, buf, len, IV))) {
+					if (h)
+						xfree(h);
					return (DEATTACK_DETECTED);
-				else
+				} else
					break;
			}
			for (d = buf; d < c; d += SSH_BLOCKSIZE) {
				if (!CMP(c, d)) {
-					if ((check_crc(c, buf, len, IV)))
+					if ((check_crc(c, buf, len, IV))) {
+						if (h)
+							xfree(h);
						return (DEATTACK_DETECTED);
-					else
+					} else
						break;
				}
			}
		}
+		if (h)
+			xfree(h);
		return (DEATTACK_OK);
	}
	memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);
@@ -138,19 +144,25 @@
		    i = (i + 1) & (n - 1)) {
			if (h[i] == HASH_IV) {
				if (!CMP(c, IV)) {
-					if (check_crc(c, buf, len, IV))
+					if (check_crc(c, buf, len, IV)) {
+						if (h)
+							xfree(h);
						return (DEATTACK_DETECTED);
-					else
+					} else
						break;
				}
			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
-				if (check_crc(c, buf, len, IV))
+				if (check_crc(c, buf, len, IV)) {
+					if (h)
+						xfree(h);
					return (DEATTACK_DETECTED);
-				else
+				} else
					break;
			}
		}
		h[i] = j;
	}
+	if (h)
+		xfree(h);
	return (DEATTACK_OK);
}


cheers,
scott rankin

_________________________________________________________________
Get MSN 8 and enjoy automatic e-mail virus protection.  
http://join.msn.com/?page=features/virus