Skip to content

Commit 4b948e6

Browse files
ejohnstownpadelsbach
authored andcommitted
sftp: NULL fName after free in all readdir variants
- Apply the prior FATFS fix across Nucleus, MQX, Windows, Zephyr, Harmony, and user-filesystem readdir paths. - Prevents double-free crash when SFTPNAME_free runs on a name struct after readdir returns an error.
1 parent 0169eb4 commit 4b948e6

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

src/wolfsftp.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2820,6 +2820,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
28202820
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
28212821
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
28222822
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2823+
out->fName = NULL;
28232824
return WS_FATAL_ERROR;
28242825
}
28252826

@@ -2889,13 +2890,15 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
28892890
>= (int)sizeof(r)) {
28902891
WLOG(WS_LOG_SFTP, "Path length too large");
28912892
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2893+
out->fName = NULL;
28922894
return WS_FATAL_ERROR;
28932895
}
28942896
}
28952897
else {
28962898
if (out->fSz + 1 > (sizeof r)) {
28972899
WLOG(WS_LOG_SFTP, "Path length too large");
28982900
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2901+
out->fName = NULL;
28992902
return WS_FATAL_ERROR;
29002903
}
29012904
WSTRNCPY(r, out->fName, sizeof(r));
@@ -2904,6 +2907,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
29042907
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
29052908
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
29062909
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2910+
out->fName = NULL;
29072911
return WS_FATAL_ERROR;
29082912
}
29092913

@@ -2930,6 +2934,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
29302934
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
29312935
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
29322936
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2937+
out->fName = NULL;
29332938
return WS_FATAL_ERROR;
29342939
}
29352940

@@ -2987,12 +2992,14 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
29872992
>= (int)sizeof(r)) {
29882993
WLOG(WS_LOG_SFTP, "Path length too large");
29892994
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
2995+
out->fName = NULL;
29902996
return WS_FATAL_ERROR;
29912997
}
29922998

29932999
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
29943000
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
29953001
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3002+
out->fName = NULL;
29963003
return WS_FATAL_ERROR;
29973004
}
29983005

@@ -3007,6 +3014,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
30073014
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
30083015
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
30093016
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3017+
out->fName = NULL;
30103018
return WS_FATAL_ERROR;
30113019
}
30123020

@@ -3084,6 +3092,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
30843092
buf = (char*)WMALLOC(bufSz, out->heap, DYNTYPE_SFTP);
30853093
if (buf == NULL) {
30863094
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3095+
out->fName = NULL;
30873096
return WS_MEMORY_E;
30883097
}
30893098

@@ -3105,6 +3114,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
31053114
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
31063115
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
31073116
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3117+
out->fName = NULL;
31083118
return WS_FATAL_ERROR;
31093119
}
31103120

@@ -3221,11 +3231,13 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
32213231
>= (int)sizeof(r)) {
32223232
WLOG(WS_LOG_SFTP, "Path length too large");
32233233
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3234+
out->fName = NULL;
32243235
return WS_FATAL_ERROR;
32253236
}
32263237

32273238
if (wolfSSH_RealPath(ssh->sftpDefaultPath, r, s, sizeof(s)) < 0) {
32283239
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3240+
out->fName = NULL;
32293241
WLOG(WS_LOG_SFTP, "Error cleaning path to get attributes");
32303242
return WS_FATAL_ERROR;
32313243
}
@@ -3241,6 +3253,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
32413253
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
32423254
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
32433255
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3256+
out->fName = NULL;
32443257
return WS_FATAL_ERROR;
32453258
}
32463259

@@ -3298,6 +3311,7 @@ static int wolfSSH_SFTPNAME_readdir(WOLFSSH* ssh, WDIR* dir, WS_SFTPNAME* out,
32983311
if (SFTP_CreateLongName(out) != WS_SUCCESS) {
32993312
WLOG(WS_LOG_DEBUG, "Error creating long name for %s", out->fName);
33003313
WFREE(out->fName, out->heap, DYNTYPE_SFTP);
3314+
out->fName = NULL;
33013315
return WS_FATAL_ERROR;
33023316
}
33033317
return WS_SUCCESS;

0 commit comments

Comments
 (0)