[Bug 3997] New: ssh-keygen: print_cert() leaks fingerprints returned by sshkey_fingerprint()

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=3997

            Bug ID: 3997
           Summary: ssh-keygen: print_cert() leaks fingerprints returned
                    by sshkey_fingerprint()
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: minor
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: eesina at astralinux.ru

In ssh-keygen.c, print_cert() allocates two fingerprint strings using
sshkey_fingerprint():

    key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT);
    ca_fp = sshkey_fingerprint(key->cert->signature_key,
        fingerprint_hash, SSH_FP_DEFAULT);

The strings are used for output only:

    printf("        Public key: %s %s\n", sshkey_type(key), key_fp);
    printf("        Signing CA: %s %s (using %s)\n",
        sshkey_type(key->cert->signature_key), ca_fp,
        key->cert->signature_type);

Since key_fp and ca_fp are automatic local pointer
variables, the allocated fingerprint strings become unreachable when
the function returns. A minimal fix is to free both strings after their
final use in print_cert().

The issue appears to be a small local memory leak in ssh-keygen when
printing SSH certificate information.

Suggested patch:
diff --git a/ssh-keygen.c b/ssh-keygen.c
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -XXXX,6 +XXXX,8 @@ print_cert(struct sshkey *key)
     else {
         printf("\n");
         show_options(key->cert->extensions, 0);
     }
+    free(key_fp);
+    free(ca_fp);
 }

-- 
You are receiving this mail because:
You are watching the assignee of the bug.