From 28652bca29046f62c7045e933e6b931de1d16737 Mon Sep 17 00:00:00 2001 From: "markus@openbsd.org" Date: Mon, 19 Sep 2016 19:02:19 +0000 Subject: upstream commit move inbound NEWKEYS handling to kex layer; otherwise early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed with & ok djm@ Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f --- kex.c | 4 +++- packet.c | 6 ++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/kex.c b/kex.c index f4c130f..8800d40 100644 --- a/kex.c +++ b/kex.c @@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt) ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error); if ((r = sshpkt_get_end(ssh)) != 0) return r; + if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0) + return r; kex->done = 1; sshbuf_reset(kex->peer); /* sshbuf_reset(kex->my); */ diff --git a/packet.c b/packet.c index 711091d..fb316ac 100644 --- a/packet.c +++ b/packet.c @@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) return r; return SSH_ERR_PROTOCOL_ERROR; } - if (*typep == SSH2_MSG_NEWKEYS) - r = ssh_set_newkeys(ssh, MODE_IN); - else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side) + if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side) r = ssh_packet_enable_delayed_compress(ssh); else r = 0; -- cgit v0.12 0