wolfsshd: fix uninitialized fileNames[] deref in HandleInclude

Author: yosuke-wolfssl

apps/wolfsshd/configuration.c

@@ -723,7 +723,7 @@ static int HandleInclude(WOLFSSHD_CONFIG *conf, const char *value, int depth)
 
             if (ret == WS_SUCCESS) {
                 if (!WOPENDIR(NULL, conf->heap, &d, path)) {
-                    word32 fileCount = 0, i, j;
+                    word32 fileCount = 0, fileFilled = 0, i, j;
                     char** fileNames = NULL;
 
                     /* Count up the number of files */
@@ -749,6 +749,12 @@ static int HandleInclude(WOLFSSHD_CONFIG *conf, const char *value, int depth)
                         if (fileNames == NULL) {
                             ret = WS_MEMORY_E;
                         }
+                        else {
+                            /* Zero so any slot not filled by the second pass
+                             * (e.g. files removed from the directory between
+                             * the two passes) is NULL rather than garbage. */
+                            WMEMSET(fileNames, 0, fileCount * sizeof(char*));
+                        }
                     }
 
                     if (ret == WS_SUCCESS) {
@@ -777,8 +783,12 @@ static int HandleInclude(WOLFSSHD_CONFIG *conf, const char *value, int depth)
                                 i++;
                             }
                         }
+                        /* Only process slots actually filled by the second
+                         * pass; the directory may have shrunk since the
+                         * count pass. */
+                        fileFilled = i;
 
-                        for (i = 0; i < fileCount; i++) {
+                        for (i = 0; i < fileFilled; i++) {
                             /* Check if filename prefix matches */
                             if (prefixLen > 0) {
                                 if ((int)WSTRLEN(fileNames[i]) <= prefixLen) {