[Bug 4045] New: ssh-keygen -Q -l leaks parsed keys in krl_dump()

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4045

            Bug ID: 4045
           Summary: ssh-keygen -Q -l leaks parsed keys in krl_dump()
           Product: Portable OpenSSH
           Version: 10.6p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: trivial
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: danilobirbiglia at gmail.com

Created attachment 4017
  --> https://bugzilla.mindrot.org/attachment.cgi?id=4017&action=edit
Patch and LeakSanitizer reproduction log

In krl_dump() (krl.c), explicitly revoked public keys are parsed using
sshkey_from_blob(), but the success path calls free(key) instead of
sshkey_free(key)
The fingerprint error path also continues without freeing the parsed
key

I reproduced this with an instrumented OpenSSH 10.6p1 build using the
real ssh-keygen -Q -l` command
LeakSanitizer reported leaks for Ed25519 (33 bytes), RSA-2048 (800
bytes) and ECDSA-P256 (1596 bytes)

Replacing free(key) with sshkey_free(key) and freeing the key on the
error path eliminated the leaks for all three key types in a separate
build

This is a confirmed memory management defect in a local cli

-- 
You are receiving this mail because:
You are watching the assignee of the bug.