On Sat, 27 Mar 2010, Matthew Haub wrote:
> Hello,
>
> If channel_by_id() in mux_master_control_cleanup_cb() fails to find the
> session channel then pointer "sc" will be NULL when dereferenced.
Applied - thanks. This case shouldn't happen, if you are able to hit
this code then please tell me how you do it :|
> Index: usr.bin/ssh/mux.c
> ===================================================================
> RCS file: /cvs/src/usr.bin/ssh/mux.c,v
> retrieving revision 1.14
> diff -u usr.bin/ssh/mux.c
> --- usr.bin/ssh/mux.c 30 Jan 2010 02:54:53 -0000 1.14
> +++ usr.bin/ssh/mux.c 27 Mar 2010 09:42:44 -0000
> @@ -189,7 +189,7 @@
> fatal("%s: channel_by_id(%i) == NULL", __func__, cid);
> if (c->remote_id != -1) {
> if ((sc = channel_by_id(c->remote_id)) == NULL)
> - debug2("%s: channel %d n session channel %d",
> + fatal("%s: channel %d missing session channel %d",
> __func__, c->self, c->remote_id);
> c->remote_id = -1;
> sc->ctl_chan = -1;
