Fix NULL pointer access #11024
Closed
Fix NULL pointer access #11024
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We need to check against NULL here because it can be called before `ssh_attach` stuffs the easy handle into the session's abstract storage.
bagder
approved these changes
Apr 25, 2023
|
How come this has never been an issue before? Shouldn't data always be valid there? The only way I can see this happening is the "abstract" (user-supplied pointer) parameter was NULL the last time it was set, and AFAICT we only set abstract on init when CURL_DEBUG but I'm not sure why: Lines 3272 to 3278 in b16d1fa Edit: Looks like 8b5f100 is biting us. |
jay
added a commit
to jay/curl
that referenced
this pull request
Apr 25, 2023
- Always set the libssh2 'abstract' user-pointer to the libcurl easy handle associated with the ssh session, so it is always passed to the ssh keyboard callback. Prior to this change and since 8b5f100 (precedes curl 8.0.0), if libcurl was built without CURL_DEBUG then it could crash during the ssh auth phase due to a null dereference in the ssh keyboard callback. Reported-by: Andreas Falkenhahn Fixes curl#11024 Closes #xxxx
|
Closing in favor of #11026. @afalkenhahn please test |
|
I can confirm that #11026 fixes the issue. |
jay
added a commit
that referenced
this pull request
Apr 26, 2023
- Always set the libssh2 'abstract' user-pointer to the libcurl easy handle associated with the ssh session, so it is always passed to the ssh keyboard callback. Prior to this change and since 8b5f100 (precedes curl 8.0.0), if libcurl was built without CURL_DEBUG then it could crash during the ssh auth phase due to a null dereference in the ssh keyboard callback. Reported-by: Andreas Falkenhahn Fixes #11024 Closes #11026
|
Thanks |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
We need to check against NULL here because
kbd_callbackcan be called beforessh_attachstuffs the easy handle into the session's abstract storage.