two minor memory leaks

[Pete Flugstad]

I think I've found two minor memory management issues (neither 
exploitable in any way) in OpenSSH 3.7.1p2 that should probably be 
addressed.

In serverloop.c, function server_input_channel_open(), the ctype 
variable is a char *, dynamically allocated in packet_get_string.  It's 
xfree'd at the end of the function.  However, before that, it's passed 
to server_request_session/server_request_direct_tcpip, which call 
either channel_new or channel_connect_to, passing in ctype.  The channel 
structure keeps a pointer to ctype, so when server_input_channel_open 
returns, and xfree's the ctype pointer, the pointer held by the channel 
structure is now pointing at free'd memory.  The channel never appears 
to use the ctype at all (at least on the server side), so it's probably 
not a problem, but it probably should be fixed for the future.

In auth2-pubkey.c, the function userauth_pubkey(), around line 98 
(inside the have_sig condition) buffer_init is called in the b variable 
- this malloc's a buffer of 4096 bytes.  Later, around line 128, buffer 
clear is called.  This resets the internal buffer pointers, but does not 
free the malloc'd memory.  I believe this should be buffer_free, as the 
variable is not used again, and no pointers are kept to it's malloc'd 
data.  When the function returns, the pointer to the malloc'd data is lost.

Thanks,
Pete