[Bug 996] Fatal error in xfree() when scp invokes ssh with a LocalForward config

[bugzilla-daemon at mindrot.org]

http://bugzilla.mindrot.org/show_bug.cgi?id=996

           Summary: Fatal error in xfree() when scp invokes ssh with a
                    LocalForward config
           Product: Portable OpenSSH
           Version: 4.0p1
          Platform: All
        OS/Version: FreeBSD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ssh
        AssignedTo: openssh-bugs at mindrot.org
        ReportedBy: mindrot at ee.lbl.gov


The routine clear_forwardings() can call xfree() with a nil pointer if you have
a .ssh/config similar to this:

    Host mindrot.org
        LocalForward 12345 localhost:54321

This seems to happen with ssh when scp invokes it to connect to the remote host,
for example:

    % scp mindrot.org:.cshrc /dev/null
    xfree: NULL pointer given as argument

gdb shows this happens on this line in readconf.c:

    xfree(options->local_forwards[i].listen_host);

It's possible (perhaps likely) there are other similar problems in this routine.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.