[libssh2] #257: libssh2_session_free: infinite loop

#257: libssh2_session_free: infinite loop
----------------------+--------------------
 Reporter: greg2001 | Owner:
     Type: defect | Status: new
 Priority: normal | Milestone: 1.4.3
Component: API | Version: 1.4.2
 Keywords: | Blocked By:
   Blocks: |
----------------------+--------------------
 Hi libssh2 developers!
 First, thank you very much for the awesome library: I'm using it (in
 combination with Boost ASIO) in a client(iOS)/server(Linux) application
 with a lot of channels per single SSH session and a lot of data
 transferred back and forth - and everything works great!

 Only a small bug:
 Let's suppose, we have a session with active forward listeners - and the
 connection breaks. Calling libssh2_session_free in this situation would
 produce an infinite loop when trying to cancel the forward listeners:
 -----------------------------------------------
         while ((l = _libssh2_list_first(&session->listeners))) {
             rc = _libssh2_channel_forward_cancel(l);
             if (rc == LIBSSH2_ERROR_EAGAIN)
                 return rc;
         }
 -----------------------------------------------

 A short look into _libssh2_channel_forward_cancel reveals the following:
 -----------------------------------------------
         rc = _libssh2_transport_send(session, packet, packet_len, NULL,
 0);
         if (rc == LIBSSH2_ERROR_EAGAIN) {
             ...
         }
         else if (rc) {
             _libssh2_error(session, LIBSSH2_ERROR_SOCKET_SEND,
                            "Unable to send global-request packet for
 forward "
                            "listen request");
             LIBSSH2_FREE(session, packet);
             listener->chanFwdCncl_state = libssh2_NB_state_idle;
             return LIBSSH2_ERROR_SOCKET_SEND;
         }
 -----------------------------------------------
 So, in case of a comm failure, the listener will never be destroyed
 causing the infinite loop. Removing the block after "else if (rc)" fixes
 the bug. For some reasons, I got this bug only after upgrade to 1.4.3,
 1.4.2 was fine...

 Another one really small thing: at the end of
 _libssh2_channel_forward_cancel, the following line accesses already de-
 allocated memory:
 -----------------------------------------------
     listener->chanFwdCncl_state = libssh2_NB_state_idle;
 -----------------------------------------------

 WBR
 Gregory Moltchadski

-- 
Ticket URL: <https://trac.libssh2.org/ticket/257>
libssh2 <https://trac.libssh2.org/>
C library for writing portable SSH2 clients
_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel