RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: fix double-free caused by compat_kex_proposal(); bz3522 

by dtucker@, ok me

OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80
This commit is contained in:
djm@openbsd.org 2023-02-02 12:10:05 +00:00 committed by Damien Miller
parent 79efd95ab5
commit 12da782333
No known key found for this signature in database
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
compat.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: compat.c,v 1.120 2022/07/01 03:35:45 dtucker Exp $ */ /* $OpenBSD: compat.c,v 1.121 2023/02/02 12:10:05 djm Exp $ */
/* /*
* Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
* *
@ -190,26 +190,26 @@ compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
char * char *
compat_kex_proposal(struct ssh *ssh, char *p) compat_kex_proposal(struct ssh *ssh, char *p)
{ {
char *cp = NULL; char *cp = NULL, *cp2 = NULL;
if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0) if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
return xstrdup(p); return xstrdup(p);
debug2_f("original KEX proposal: %s", p); debug2_f("original KEX proposal: %s", p);
if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0) if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
if ((p = match_filter_denylist(p, if ((cp = match_filter_denylist(p,
"curve25519-sha256@libssh.org")) == NULL) "curve25519-sha256@libssh.org")) == NULL)
fatal("match_filter_denylist failed"); fatal("match_filter_denylist failed");
if ((ssh->compat & SSH_OLD_DHGEX) != 0) { if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
cp = p; if ((cp2 = match_filter_denylist(cp ? cp : p,
if ((p = match_filter_denylist(p,
"diffie-hellman-group-exchange-sha256," "diffie-hellman-group-exchange-sha256,"
"diffie-hellman-group-exchange-sha1")) == NULL) "diffie-hellman-group-exchange-sha1")) == NULL)
fatal("match_filter_denylist failed"); fatal("match_filter_denylist failed");
free(cp); free(cp);
cp = cp2;
} }
debug2_f("compat KEX proposal: %s", p); if (cp == NULL || *cp == '\0')
if (*p == '\0')
fatal("No supported key exchange algorithms found"); fatal("No supported key exchange algorithms found");
return p; debug2_f("compat KEX proposal: %s", cp);
return cp;
} }