those 2 functions have conditions that
return without freeing memory.
(Suggestions from armani@).

Index: sftp-client.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sftp-client.c,v
retrieving revision 1.94
diff -u -p -r1.94 sftp-client.c
--- sftp-client.c       4 Dec 2010 00:18:01 -0000       1.94
+++ sftp-client.c       20 Jul 2011 20:14:17 -0000
@@ -798,8 +798,6 @@ do_hardlink(struct sftp_conn *conn, char
        Buffer msg;
        u_int status, id;
 
-       buffer_init(&msg);
-
        /* Send link request */
        id = conn->msg_id++;
        if ((conn->exts & SFTP_EXT_HARDLINK) == 0) {
@@ -807,6 +805,7 @@ do_hardlink(struct sftp_conn *conn, char
                return -1;
        }
 
+       buffer_init(&msg);
        buffer_put_char(&msg, SSH2_FXP_EXTENDED);
        buffer_put_int(&msg, id);
        buffer_put_cstring(&msg, "hardl...@openssh.com");
@@ -882,6 +881,7 @@ do_readlink(struct sftp_conn *conn, char
                u_int status = buffer_get_int(&msg);
 
                error("Couldn't readlink: %s", fx2txt(status));
+               buffer_free(&msg);
                return(NULL);
        } else if (type != SSH2_FXP_NAME)
                fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",

Reply via email to