NULL a couple of members after freeing them in ssh_free(). In particular,

should stop ssh_do_close() accessing freed ssh->channels when invoked later
from ssh_free(). Spotted by Fred Sauer.

(Perhaps this is the cause of the crashes people have been reporting on
abnormal closures such as `Software caused connection abort'? I've not been
able to test this.)

git-svn-id: svn://svn.tartarus.org/sgt/putty@4946 cda61777-01e9-0310-a592-d414129be87e

diff --git a/ssh.c b/ssh.c
index e0facac..8c552b1 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -7235,12 +7235,14 @@ static void ssh_free(void *handle)
            sfree(c);
        }
        freetree234(ssh->channels);
+       ssh->channels = NULL;
     }
 
     if (ssh->rportfwds) {
        while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
            sfree(pf);
        freetree234(ssh->rportfwds);
+       ssh->rportfwds = NULL;
     }
     sfree(ssh->deferred_send_data);
     if (ssh->x11auth)