ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-02-07 13:21:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix leaks in kex fuzzers

Browse Source
This commit is contained in:
Matt Johnston 2018-03-09 23:16:37 +08:00
parent 76933e6c0a
commit d740dc5489
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fuzzer-kexdh.c
View File

@ -57,10 +57,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS);
kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey); kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey);
/* kexhashbuf is freed in kexdh_comb_key */ mp_clear(ses.dh_K);
m_free(ses.dh_K); m_free(ses.dh_K);
mp_clear(&dh_e); mp_clear(&dh_e);
buf_free(ses.hash);
buf_free(ses.session_id);
/* kexhashbuf is freed in kexdh_comb_key */
m_malloc_free_epoch(1, 0); m_malloc_free_epoch(1, 0);
} else { } else {
m_malloc_free_epoch(1, 1); m_malloc_free_epoch(1, 1);

6
fuzzer-kexecdh.c
View File

@ -63,10 +63,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS);
kexecdh_comb_key(ecdh_param, ecdh_qs, svr_opts.hostkey); kexecdh_comb_key(ecdh_param, ecdh_qs, svr_opts.hostkey);
/* kexhashbuf is freed in kexdh_comb_key */ mp_clear(ses.dh_K);
m_free(ses.dh_K); m_free(ses.dh_K);
buf_free(ecdh_qs); buf_free(ecdh_qs);
buf_free(ses.hash);
buf_free(ses.session_id);
/* kexhashbuf is freed in kexdh_comb_key */
m_malloc_free_epoch(1, 0); m_malloc_free_epoch(1, 0);
} else { } else {
m_malloc_free_epoch(1, 1); m_malloc_free_epoch(1, 1);