[openssh-commits] [openssh] 23/87: upstream: avoid pty fd leak if a session is opened, a pty is

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit b22dfc2854681d664e173d4ca28c81e4172a763f
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 02:11:00 2026 +0000

    upstream: avoid pty fd leak if a session is opened, a pty is
    
    requested and then closed before any shell/exec/subsystem request is made.
    
    Anthropic ANT-2026-F1Z1MHTE
    
    OpenBSD-Commit-ID: 0faf8e70824a7f8f293569ddbcbfca8881653904
---
 session.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/session.c b/session.c
index 47a73e945..0c0bd8084 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.352 2026/10/30 01:23:12 djm Exp $ */
+/* $OpenBSD: session.c,v 1.353 2026/10/30 02:11:00 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -551,18 +551,16 @@ do_exec_pty(struct ssh *ssh, Session *s, const char *command)
 	 * simplifies code in server_loop.  The descriptor is bidirectional.
 	 * Do this before forking (and cleanup in the child) so as to
 	 * detect and gracefully fail out-of-fd conditions.
+	 * On failure s->ptyfd and s->ttyfd remain owned by the session and
+	 * are closed by session_pty_cleanup().
 	 */
 	if ((fdout = dup(ptyfd)) == -1) {
 		error_f("dup #1: %s", strerror(errno));
-		close(ttyfd);
-		close(ptyfd);
 		return -1;
 	}
 	/* we keep a reference to the pty master */
 	if ((ptymaster = dup(ptyfd)) == -1) {
 		error_f("dup #2: %s", strerror(errno));
-		close(ttyfd);
-		close(ptyfd);
 		close(fdout);
 		return -1;
 	}
@@ -573,8 +571,6 @@ do_exec_pty(struct ssh *ssh, Session *s, const char *command)
 		error_f("fork: %.100s", strerror(errno));
 		close(fdout);
 		close(ptymaster);
-		close(ttyfd);
-		close(ptyfd);
 		return -1;
 	case 0:
 		is_child = 1;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.