[openssh-commits] [openssh] 04/06: upstream: Fix double frees (impossible to reach outside of a test

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 05000bc5ea80485540bac655f83b65d7f868af11
Author: deraadt at openbsd.org <deraadt at openbsd.org>
AuthorDate: Thu Jul 30 03:13:34 2026 +0000

    upstream: Fix double frees (impossible to reach outside of a test
    
    harness), and also use freezero where possible from Christopher Paul Rohlf at
    Anthropic ok djm
    
    OpenBSD-Commit-ID: 50227bff4ffd4a93aad399f21fc20f1c3cbf2c69
---
 ssh-mldsa-eddsa.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/ssh-mldsa-eddsa.c b/ssh-mldsa-eddsa.c
index 9371169fc..d5cb3d9a0 100644
--- a/ssh-mldsa-eddsa.c
+++ b/ssh-mldsa-eddsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.2 2026/07/14 04:43:13 djm Exp $ */
+/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.3 2026/07/30 03:13:34 deraadt Exp $ */
 /*
  * Copyright (c) 2026 Damien Miller <djm at mindrot.org>
  *
@@ -350,12 +350,15 @@ ssh_mldsa44_ed25519_generate(struct sshkey *k, int bits)
 	if ((k->mldsa_ed25519_pk = malloc(MLDSA44_ED25519_PK_SZ)) == NULL ||
 	    (k->mldsa_ed25519_sk = malloc(MLDSA44_ED25519_SK_SZ)) == NULL) {
 		free(k->mldsa_ed25519_pk);
+		k->mldsa_ed25519_pk = NULL;
 		return SSH_ERR_ALLOC_FAIL;
 	}
 	if (crypto_sign_mldsa44_ed25519_keygen(k->mldsa_ed25519_pk,
 	    k->mldsa_ed25519_sk) != 0) {
-		free(k->mldsa_ed25519_pk);
-		free(k->mldsa_ed25519_sk);
+		freezero(k->mldsa_ed25519_pk, MLDSA44_ED25519_PK_SZ);
+		k->mldsa_ed25519_pk = NULL;
+		freezero(k->mldsa_ed25519_sk, MLDSA44_ED25519_PK_SZ);
+		k->mldsa_ed25519_sk = NULL;
 		return SSH_ERR_CRYPTO_ERROR;
 	}
 	return 0;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.