From 74eff86a6bb54e9c44eae5bbb6d3b396a9f18a85 Mon Sep 17 00:00:00 2001
From: milo <milo.sshiva@gmail.com>
Date: Tue, 28 Jul 2009 18:01:07 +0200
Subject: Fix possible memory corruption (#14)

Signed-off-by: Andreas Schneider <mail@cynapses.org>
---
 libssh/dh.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'libssh/dh.c')

diff --git a/libssh/dh.c b/libssh/dh.c
index d9262150..84cc2149 100644
--- a/libssh/dh.c
+++ b/libssh/dh.c
@@ -626,20 +626,20 @@ int hashbufout_add_cookie(SSH_SESSION *session) {
   }
 
   if (buffer_add_u8(session->out_hashbuf, 20) < 0) {
-    buffer_free(session->out_hashbuf);
+    buffer_reinit(session->out_hashbuf);
     return -1;
   }
 
   if (session->server) {
     if (buffer_add_data(session->out_hashbuf,
           session->server_kex.cookie, 16) < 0) {
-      buffer_free(session->out_hashbuf);
+      buffer_reinit(session->out_hashbuf);
       return -1;
     }
   } else {
     if (buffer_add_data(session->out_hashbuf,
           session->client_kex.cookie, 16) < 0) {
-      buffer_free(session->out_hashbuf);
+      buffer_reinit(session->out_hashbuf);
       return -1;
     }
   }
@@ -654,11 +654,11 @@ int hashbufin_add_cookie(SSH_SESSION *session, unsigned char *cookie) {
   }
 
   if (buffer_add_u8(session->in_hashbuf, 20) < 0) {
-    buffer_free(session->in_hashbuf);
+    buffer_reinit(session->in_hashbuf);
     return -1;
   }
   if (buffer_add_data(session->in_hashbuf,cookie, 16) < 0) {
-    buffer_free(session->in_hashbuf);
+    buffer_reinit(session->in_hashbuf);
     return -1;
   }
 
-- 
cgit