49 lines
1.4 KiB
Diff
49 lines
1.4 KiB
Diff
|
From 28652bca29046f62c7045e933e6b931de1d16737 Mon Sep 17 00:00:00 2001
|
||
|
|
From: "markus@openbsd.org" <markus@openbsd.org>
|
||
|
|
Date: Mon, 19 Sep 2016 19:02:19 +0000
|
||
|
|
Subject: upstream commit
|
||
|
|
|
||
|
|
move inbound NEWKEYS handling to kex layer; otherwise
|
||
|
|
early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed
|
||
|
|
with & ok djm@
|
||
|
|
|
||
|
|
Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f
|
||
|
|
---
|
||
|
|
kex.c | 4 +++-
|
||
|
|
packet.c | 6 ++----
|
||
|
|
2 files changed, 5 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/kex.c b/kex.c
|
||
|
|
index f4c130f..8800d40 100644
|
||
|
|
--- a/kex.c
|
||
|
|
+++ b/kex.c
|
||
|
|
@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
|
||
|
|
ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
|
||
|
|
if ((r = sshpkt_get_end(ssh)) != 0)
|
||
|
|
return r;
|
||
|
|
+ if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
|
||
|
|
+ return r;
|
||
|
|
kex->done = 1;
|
||
|
|
sshbuf_reset(kex->peer);
|
||
|
|
/* sshbuf_reset(kex->my); */
|
||
|
|
diff --git a/packet.c b/packet.c
|
||
|
|
index 711091d..fb316ac 100644
|
||
|
|
--- a/packet.c
|
||
|
|
+++ b/packet.c
|
||
|
|
@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
|
||
|
|
return r;
|
||
|
|
return SSH_ERR_PROTOCOL_ERROR;
|
||
|
|
}
|
||
|
|
- if (*typep == SSH2_MSG_NEWKEYS)
|
||
|
|
- r = ssh_set_newkeys(ssh, MODE_IN);
|
||
|
|
- else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
|
||
|
|
+ if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
|
||
|
|
r = ssh_packet_enable_delayed_compress(ssh);
|
||
|
|
else
|
||
|
|
r = 0;
|
||
|
|
--
|
||
|
|
cgit v0.12
|
||
|
|
|
||
|
|
0
|
||
|
|
|