Ensure to `SSH_STRING_FREE` the pubkey_blob local in `ssh_server_dh_process_init`. The leak can be seen with valgrind and the pkd tests with:
valgrind \ --leak-check=full \ --show-leak-kinds=definite \ ./pkd_hello -i1 -t torture_pkd_openssh_rsa_rsa_diffie_hellman_group14_sha1 Signed-off-by: Jon Simons <j...@jonsimons.org> --- src/dh.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/dh.c b/src/dh.c index 9deea8d5..b4b988d9 100644 --- a/src/dh.c +++ b/src/dh.c @@ -690,7 +690,8 @@ int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet) pubkey_blob, session->next_crypto->f, sig_blob); - ssh_string_free(sig_blob); + SSH_STRING_FREE(sig_blob); + SSH_STRING_FREE(pubkey_blob); if(rc != SSH_OK) { ssh_set_error_oom(session); ssh_buffer_reinit(session->out_buffer); @@ -717,6 +718,8 @@ error: if (!bignum_ctx_invalid(ctx)) { bignum_ctx_free(ctx); } + SSH_STRING_FREE(sig_blob); + SSH_STRING_FREE(pubkey_blob); session->session_state = SSH_SESSION_STATE_ERROR; ssh_dh_cleanup(session->next_crypto); -- 2.19.1.593.gc670b1f