[poll] avoid infinite loop in ssh_poll_ctx_free()

(cherry picked from commit 809254160308289fdcddf8a5eabad0c85a35bce7)

1 files changed, 7 insertions, 2 deletions

diff --git a/src/poll.c b/src/poll.c
index 87988608..bfcc4ad4 100644
--- a/src/poll.c
+++ b/src/poll.c
@@ -491,8 +491,13 @@ void ssh_poll_ctx_free(ssh_poll_ctx ctx) {
       socket_t fd = ctx->pollfds[i].fd;
 
       /* force poll object removal */
-      if (p->cb(p, fd, POLLERR, p->cb_data) < 0) {
-        used = ctx->polls_used;
+      if (p->cb && p->cb(p, fd, POLLERR, p->cb_data) < 0) {
+        if(ctx->polls_used < used) {
+            used = ctx->polls_used;
+        } else {
+            /* nothing to do */
+            i++;
+        }
       } else {
         i++;
       }