From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 1 Dec 2025 15:32:39 +0000 (+0100)
Subject: libssh2: consider strdup() failures OOM and return correctly
X-Git-Tag: rc-8_18_0-1~52
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=85a6936d7669748983ec340519df325eea9c9333;p=thirdparty%2Fcurl.git

libssh2: consider strdup() failures OOM and return correctly

In the ssh_state_pkey_init function.

Closes #19791
---

diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
index 8701775d7d..4437724fcf 100644
--- a/lib/vssh/libssh2.c
+++ b/lib/vssh/libssh2.c
@@ -1205,8 +1205,11 @@ static CURLcode ssh_state_pkey_init(struct Curl_easy *data,
 
     sshc->rsa_pub = sshc->rsa = NULL;
 
-    if(data->set.str[STRING_SSH_PRIVATE_KEY])
+    if(data->set.str[STRING_SSH_PRIVATE_KEY]) {
       sshc->rsa = curlx_strdup(data->set.str[STRING_SSH_PRIVATE_KEY]);
+      if(!sshc->rsa)
+        out_of_memory = TRUE;
+    }
     else {
       /* To ponder about: should really the lib be messing about with the
          HOME environment variable etc? */
@@ -1251,7 +1254,7 @@ static CURLcode ssh_state_pkey_init(struct Curl_easy *data,
      * libssh2 extract the public key from the private key file.
      * This is done by simply passing sshc->rsa_pub = NULL.
      */
-    if(data->set.str[STRING_SSH_PUBLIC_KEY]
+    if(!out_of_memory && data->set.str[STRING_SSH_PUBLIC_KEY]
        /* treat empty string the same way as NULL */
        && data->set.str[STRING_SSH_PUBLIC_KEY][0]) {
       sshc->rsa_pub = curlx_strdup(data->set.str[STRING_SSH_PUBLIC_KEY]);