From 0d7cb7230dba5af01068980429efcae34602f926 Mon Sep 17 00:00:00 2001 From: TapTap Date: Mon, 20 Jul 2026 17:14:57 +0200 Subject: [PATCH] fix: remove use-after-free in transport_ssh.c child process remote_dest_destroy(&r) was called before r.user and r.host were accessed to build the SSH username string. Since the child process _exit()s, memory cleanup is unnecessary there. --- src/shared/transport_ssh.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/shared/transport_ssh.c b/src/shared/transport_ssh.c index 71f1e3d..0462ce4 100644 --- a/src/shared/transport_ssh.c +++ b/src/shared/transport_ssh.c @@ -111,9 +111,6 @@ Client* client_connect_ssh(const char* destination, int port) { close(sv[0]); close(exec_pipe[0]); fcntl(exec_pipe[1], F_SETFD, FD_CLOEXEC); - // Child doesn't need the RemoteDest strings - remote_dest_destroy(&r); - if (sv[1] != STDIN_FILENO) dup2(sv[1], STDIN_FILENO); if (sv[1] != STDOUT_FILENO)