[openssh-commits] [openssh] 13/15: fuzz: always free key in privkey_fuzz to prevent resource leak

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit 50a8648252887ad2c6ccc57b3822362e4ec98117
Author: OwenSanzas <zesheng at tamu.edu>
AuthorDate: Wed Apr 8 23:02:05 2026 +0000

    fuzz: always free key in privkey_fuzz to prevent resource leak
    
    If sshkey_private_deserialize() fails but partially allocates k,
    the key object is leaked since sshkey_free() is only called on
    success (r == 0). Always call sshkey_free(k) since it is NULL-safe.
    
    This matches the pattern used in other fuzz harnesses like
    sshsig_fuzz which unconditionally free resources.
---
 regress/misc/fuzz-harness/privkey_fuzz.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/regress/misc/fuzz-harness/privkey_fuzz.cc b/regress/misc/fuzz-harness/privkey_fuzz.cc
index ff0b0f776..e20d80abe 100644
--- a/regress/misc/fuzz-harness/privkey_fuzz.cc
+++ b/regress/misc/fuzz-harness/privkey_fuzz.cc
@@ -11,8 +11,8 @@ int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
 	struct sshkey *k = NULL;
 	struct sshbuf *b = sshbuf_from(data, size);
-	int r = sshkey_private_deserialize(b, &k);
-	if (r == 0) sshkey_free(k);
+	(void)sshkey_private_deserialize(b, &k);
+	sshkey_free(k);
 	sshbuf_free(b);
 	return 0;
 }

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.