26 lines
854 B
Diff
26 lines
854 B
Diff
From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
|
|
From: Will Cosgrove <will@panic.com>
|
|
Date: Thu, 2 Jul 2026 11:00:23 -0700
|
|
Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
|
|
|
|
Set data to NULL after freeing it to avoid dangling pointer. fixes
|
|
GHSA-px3w-7g75-hg7w.
|
|
|
|
Credit: VladimirEliTokarev
|
|
---
|
|
src/sftp.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/src/sftp.c b/src/sftp.c
|
|
index ec3a8ae18a..842eb6ea51 100644
|
|
--- a/src/sftp.c
|
|
+++ b/src/sftp.c
|
|
@@ -1259,6 +1259,7 @@ static LIBSSH2_SFTP_HANDLE *sftp_open(LIBSSH2_SFTP *sftp,
|
|
ssh2_deb((session, LIBSSH2_TRACE_SFTP, "got HANDLE FXOK"));
|
|
|
|
SSH2_FREE(session, data);
|
|
+ data = NULL;
|
|
|
|
/* silly situation, but check for a HANDLE */
|
|
rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,
|