ftp: free the response code as a boxed slice

parse_response_line allocates the code buffer with Box::into_raw on a
boxed slice, but SCFTPFreeResponseLine released it by rebuilding a
Vec<u8> with capacity code_length. Vec::from_raw_parts accepts any
global-allocator pointer whose size and alignment match, and both paths
compute the same layout for a byte slice, so the old free was sound. It
differed only from how the response buffer is released.

Release the code buffer through Box::from_raw on a slice pointer, so
both buffers are freed the same way they were allocated.

Ticket: 8803
pull/16459/head
Jeff Lucovsky 2 weeks ago committed by Victor Julien
parent 0c534c9ccd
commit 2054e9bfcf

@ -1,4 +1,4 @@
/* Copyright (C) 2025 Open Information Security Foundation
/* Copyright (C) 2025-2026 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -104,7 +104,10 @@ pub unsafe extern "C" fn SCFTPFreeResponseLine(response: *mut FTPResponseLine) {
let response = Box::from_raw(response);
if !response.response.is_null() {
let _ = Vec::from_raw_parts(response.code, response.code_length, response.code_length);
let _ = Box::from_raw(std::ptr::slice_from_raw_parts_mut(
response.code,
response.code_length,
));
}
if !response.response.is_null() {

Loading…
Cancel
Save