OpenSSH 3.2.2p1 sshd: fatal: xfree: NULL pointer given as argument

[Markus Friedl]

could you please print put b.buf after buffer_init and before buffer_free ?

On Mon, May 20, 2002 at 01:27:01PM -0500, Phil Howard wrote:
> So kexgex.c at line 93 looks like the culprit.  The code around there
> looks like (with my change in place):
> =============================================================================
> static u_char *
> kexgex_hash(
>     char *client_version_string,
>     char *server_version_string,
>     char *ckexinit, int ckexinitlen,
>     char *skexinit, int skexinitlen,
>     u_char *serverhostkeyblob, int sbloblen,
>     int min, int wantbits, int max, BIGNUM *prime, BIGNUM *gen,
>     BIGNUM *client_dh_pub,
>     BIGNUM *server_dh_pub,
>     BIGNUM *shared_secret)
> {
>         Buffer b;
>         static u_char digest[EVP_MAX_MD_SIZE];
>         const EVP_MD *evp_md = EVP_sha1();
>         EVP_MD_CTX md;
> 
>         buffer_init(&b);

allocates
	b.buf

>         buffer_put_cstring(&b, client_version_string);
>         buffer_put_cstring(&b, server_version_string);
> 
>         /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
>         buffer_put_int(&b, ckexinitlen+1);
>         buffer_put_char(&b, SSH2_MSG_KEXINIT);
>         buffer_append(&b, ckexinit, ckexinitlen);
>         buffer_put_int(&b, skexinitlen+1);
>         buffer_put_char(&b, SSH2_MSG_KEXINIT);
>         buffer_append(&b, skexinit, skexinitlen);
> 
>         buffer_put_string(&b, serverhostkeyblob, sbloblen);
>         if (min == -1 || max == -1)
>                 buffer_put_int(&b, wantbits);
>         else {
>                 buffer_put_int(&b, min);
>                 buffer_put_int(&b, wantbits);
>                 buffer_put_int(&b, max);
>         }
>         buffer_put_bignum2(&b, prime);
>         buffer_put_bignum2(&b, gen);
>         buffer_put_bignum2(&b, client_dh_pub);
>         buffer_put_bignum2(&b, server_dh_pub);
>         buffer_put_bignum2(&b, shared_secret);
> 
> #ifdef DEBUG_KEXDH
>         buffer_dump(&b);
> #endif
>         EVP_DigestInit(&md, evp_md);
>         EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
>         EVP_DigestFinal(&md, digest, NULL);
> 
> {debug3("kexgex.c#93 buffer_free");buffer_free(&b);}

free's
	b.buf