From 385412454f13d65c5bb7c9ead2f75c1976f077fb Mon Sep 17 00:00:00 2001 From: iefa m Date: Tue, 27 Oct 2026 08:10:36 +0530 Subject: [PATCH] handle_server_error: don't stash a pointer into the freed message --- logsrvd/logsrvd_relay.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/logsrvd/logsrvd_relay.c b/logsrvd/logsrvd_relay.c index f7c8f660e1..28c28aafd9 100644 --- a/logsrvd/logsrvd_relay.c +++ b/logsrvd/logsrvd_relay.c @@ -650,8 +650,12 @@ handle_server_error(const char *errmsg, struct connection_closure *closure) sudo_ev_del(closure->evbase, closure->relay_closure->read_ev); sudo_ev_del(closure->evbase, closure->relay_closure->write_ev); - /* Error message from relay could be missing. */ - closure->errstr = *errmsg ? errmsg : "unknown error"; + /* + * The caller frees the ServerMessage that errmsg points into before + * closure->errstr is used, so store a static string instead of errmsg + * itself. The relay's message is logged above. + */ + closure->errstr = _("error received from relay host"); debug_return_bool(false); }