[Patch 1/1]: Potential memory leak in sftp-common.c

[Chris Rapier]

Hey all,

In decode_attrib an error in the if test for vendor-specific extensions
will return without freeing type or data. I ran in to this during
a fuzz test using LeakSanitizer.

Chris

--- a/sftp-common.c
+++ b/sftp-common.c
@@ -138,9 +138,14 @@
  		if (count > 0x100000)
  			return SSH_ERR_INVALID_FORMAT;
  		for (i = 0; i < count; i++) {
+			type = NULL;
+			data = NULL;
  			if ((r = sshbuf_get_cstring(b, &type, NULL)) != 0 ||
-			    (r = sshbuf_get_string(b, &data, &dlen)) != 0)
+			    (r = sshbuf_get_string(b, &data, &dlen)) != 0) {
+				free(type);
+				free(data);
  				return r;
+			}
  			debug3("Got file attribute \"%.100s\" len %zu",
  			    type, dlen);
  			free(type);