Skip to content

SFTP torture test 1459 segfault in OOM path #6764

Description

@bagder

See build log

When libssh2_knownhost_init returns NULL we still use libssh2 in the disconnect call and then it segfaults, inside libssh2.

Program received signal SIGSEGV, Segmentation fault.
0x0000555555677217 in _libssh2_transport_send (session=0x5555557a3e78, 
    data=0x5555557b0e00 "\001", data_len=21, data2=0x5555556a391d "", data2_len=0)
    at transport.c:892
892         ret = LIBSSH2_SEND(session, p->outbuf, total_length,
(gdb) bt
#0  0x0000555555677217 in _libssh2_transport_send (session=0x5555557a3e78, 
    data=0x5555557b0e00 "\001", data_len=21, data2=0x5555556a391d "", data2_len=0)
    at transport.c:892
#1  0x000055555566870f in session_disconnect (session=0x5555557a3e78, reason=11, 
    description=0x5555556a42b6 "Shutdown", lang=0x5555556a391d "") at session.c:1155
#2  0x0000555555668781 in libssh2_session_disconnect_ex (session=0x5555557a3e78, 
    reason=11, desc=0x5555556a42b6 "Shutdown", lang=0x5555556a391d "")
    at session.c:1175
#3  0x00005555555db48c in ssh_statemach_act (data=0x555555763968, 
    block=0x7fffffffd4b7) at vssh/libssh2.c:2750
#4  0x00005555555dbbbc in ssh_block_statemach (data=0x555555763968, 
    conn=0x5555557a37c8, duringconnect=false) at vssh/libssh2.c:2944
#5  0x00005555555dc816 in sftp_disconnect (data=0x555555763968, 
    conn=0x5555557a37c8, dead_connection=true) at vssh/libssh2.c:3442
#6  0x00005555555c5796 in Curl_disconnect (data=0x555555763968, 
    conn=0x5555557a37c8, dead_connection=true) at url.c:851
#7  0x00005555555a56e4 in multi_done (data=0x555555763968, 
    status=CURLE_FAILED_INIT, premature=true) at multi.c:658

I'm using libssh2 1.9.1-DEV from git master as of today.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions