Skip to content

channels: Fix segfaults when the channel data is freed

Calling some channel procedures on a freed channel is always resulting in segmentation fault errors. The reason is that when a channel is freed with ssh_channel_do_free procedure, its session field is set to NULL; then when a channel procedure tries to access any field of channel->session structure it is effectively de-referencing a NULL pointer.

The change fixes that behavior by adding a check which ensures that a channel state is not SSH_CHANNEL_FLAG_FREED_LOCAL before accessing its parent session.

Also the test suite is updated to check for the fixed errors, and the Doxygen documentation updated accordingly.

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTING.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code
Edited by Artyom V. Poptsov

Merge request reports

Loading