search for: mux_ctx

https://bugzilla.mindrot.org/show_bug.cgi?id=3189 Bug ID: 3189 Summary: channel mux_ctx memory leak Product: Portable OpenSSH Version: 8.3p1 Hardware: ix86 OS: Linux Status: NEW Severity: critical Priority: P5 Component: ssh Assignee: unassigned-bugs at mindrot.org Reporter: se...

...struct has only an int element inside it, but it would corrupt memory if the struct were to be extended. Simple fix here: diff --git a/mux.c b/mux.c index 3f5babc..f151021 100644 --- a/mux.c +++ b/mux.c @@ -931,7 +976,7 @@ mux_master_read_cb(Channel *c) /* Setup ctx and */ if (c->mux_ctx == NULL) { - state = xcalloc(1, sizeof(state)); + state = xcalloc(1, sizeof(*state)); c->mux_ctx = state; channel_register_cleanup(c->self, mux_master_control_cleanup_cb, 0); -- -- Howard Chu CTO, Symas Corp. http://www.symas.com...

https://bugzilla.mindrot.org/show_bug.cgi?id=3162 Bug ID: 3162 Summary: Tracking bug for 8.4 release Product: Portable OpenSSH Version: -current Hardware: Other OS: All Status: NEW Keywords: meta Severity: enhancement Priority: P5 Component: Miscellaneous Assignee:

https://bugzilla.mindrot.org/show_bug.cgi?id=3117 Bug ID: 3117 Summary: Tracking bug for 8.2 release Product: Portable OpenSSH Version: -current Hardware: All OS: All Status: NEW Keywords: meta Severity: enhancement Priority: P5 Component: Miscellaneous Assignee:

...t;ctl_fd = -1; /* XXX: set elsewhere */ c->efd = efd; c->extended_usage = extusage; @@ -323,6 +322,9 @@ channel_new(char *ctype, int type, int r c->output_filter = NULL; c->filter_ctx = NULL; c->filter_cleanup = NULL; + c->ctl_chan = -1; + c->mux_rcb = NULL; + c->mux_ctx = NULL; c->delayed = 1; /* prevent call to channel_post handler */ TAILQ_INIT(&c->status_confirms); debug("channel %d: new [%s]", found, remote_name); @@ -365,11 +367,10 @@ channel_close_fd(int *fdp) static void channel_close_fds(Channel *c) { - debug3("channel %d...