From e9397868363d004750a99fc6ed97f25eba97bd6d Mon Sep 17 00:00:00 2001
From: Andreas Schneider <mail@cynapses.org>
Date: Wed, 18 Nov 2009 15:35:15 +0100
Subject: Fixed possible doulbe free problem found by Bernhard R. Link.

---
 libssh/channels.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libssh/channels.c b/libssh/channels.c
index 5cfb2ff..60d2b09 100644
--- a/libssh/channels.c
+++ b/libssh/channels.c
@@ -617,12 +617,14 @@ int channel_default_bufferize(ssh_channel channel, void *data, int len,
     if (channel->stdout_buffer == NULL) {
       channel->stdout_buffer = buffer_new();
       if (channel->stdout_buffer == NULL) {
+        ssh_set_error_oom(session);
         return -1;
       }
     }
 
     if (buffer_add_data(channel->stdout_buffer, data, len) < 0) {
       buffer_free(channel->stdout_buffer);
+      channel->stdout_buffer = NULL;
       return -1;
     }
   } else {
@@ -630,12 +632,14 @@ int channel_default_bufferize(ssh_channel channel, void *data, int len,
     if (channel->stderr_buffer == NULL) {
       channel->stderr_buffer = buffer_new();
       if (channel->stderr_buffer == NULL) {
+        ssh_set_error_oom(session);
         return -1;
       }
     }
 
     if (buffer_add_data(channel->stderr_buffer, data, len) < 0) {
       buffer_free(channel->stderr_buffer);
+      channel->stderr_buffer = NULL;
       return -1;
     }
   }
-- 
cgit