RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: Don't leak the strings allocated by order_hostkeyalgs() 

and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of
github PR#324 from ZoltanFridrich, ok djm@

This is a roll-forward of the previous rollback now that the required
changes in compat.c have been done.

OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb
This commit is contained in:
dtucker@openbsd.org 2022-07-01 03:39:44 +00:00 committed by Damien Miller
parent 486c4dc3b8
commit 6c31ba10e9
2 changed files with 21 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sshconnect2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.358 2022/06/24 10:45:06 dtucker Exp $ */ /* $OpenBSD: sshconnect2.c,v 1.359 2022/07/01 03:39:44 dtucker Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved.
@ -218,6 +218,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
{ {
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
char *s, *all_key; char *s, *all_key;
char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
int r, use_known_hosts_order = 0; int r, use_known_hosts_order = 0;
xxx_host = host; xxx_host = host;
@ -243,10 +244,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL) if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
fatal_f("kex_names_cat"); fatal_f("kex_names_cat");
myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s); myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh, s);
myproposal[PROPOSAL_ENC_ALGS_CTOS] = myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(ssh, options.ciphers); myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
myproposal[PROPOSAL_ENC_ALGS_STOC] =
compat_cipher_proposal(ssh, options.ciphers); compat_cipher_proposal(ssh, options.ciphers);
myproposal[PROPOSAL_COMP_ALGS_CTOS] = myproposal[PROPOSAL_COMP_ALGS_CTOS] =
myproposal[PROPOSAL_COMP_ALGS_STOC] = myproposal[PROPOSAL_COMP_ALGS_STOC] =
@ -255,12 +255,12 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
if (use_known_hosts_order) { if (use_known_hosts_order) {
/* Query known_hosts and prefer algorithms that appear there */ /* Query known_hosts and prefer algorithms that appear there */
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
compat_pkalg_proposal(ssh, compat_pkalg_proposal(ssh,
order_hostkeyalgs(host, hostaddr, port, cinfo)); order_hostkeyalgs(host, hostaddr, port, cinfo));
} else { } else {
/* Use specified HostkeyAlgorithms exactly */ /* Use specified HostkeyAlgorithms exactly */
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
compat_pkalg_proposal(ssh, options.hostkeyalgorithms); compat_pkalg_proposal(ssh, options.hostkeyalgorithms);
} }
@ -303,6 +303,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
(r = ssh_packet_write_wait(ssh)) != 0) (r = ssh_packet_write_wait(ssh)) != 0)
fatal_fr(r, "send packet"); fatal_fr(r, "send packet");
#endif #endif
/* Free only parts of proposal that were dynamically allocated here. */
free(prop_kex);
free(prop_enc);
free(prop_hostkey);
} }
/* /*

17
sshd.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshd.c,v 1.588 2022/06/24 10:45:06 dtucker Exp $ */ /* $OpenBSD: sshd.c,v 1.589 2022/07/01 03:39:44 dtucker Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -2368,12 +2368,14 @@ do_ssh2_kex(struct ssh *ssh)
{ {
char *myproposal[PROPOSAL_MAX] = { KEX_SERVER }; char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
struct kex *kex; struct kex *kex;
char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
int r; int r;
myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh,
options.kex_algorithms); options.kex_algorithms);
myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh, myproposal[PROPOSAL_ENC_ALGS_CTOS] =
options.ciphers); myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
compat_cipher_proposal(ssh, options.ciphers);
myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh, myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh,
options.ciphers); options.ciphers);
myproposal[PROPOSAL_MAC_ALGS_CTOS] = myproposal[PROPOSAL_MAC_ALGS_CTOS] =
@ -2388,8 +2390,8 @@ do_ssh2_kex(struct ssh *ssh)
ssh_packet_set_rekey_limits(ssh, options.rekey_limit, ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
options.rekey_interval); options.rekey_interval);
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
ssh, list_hostkey_types()); compat_pkalg_proposal(ssh, list_hostkey_types());
/* start key exchange */ /* start key exchange */
if ((r = kex_setup(ssh, myproposal)) != 0) if ((r = kex_setup(ssh, myproposal)) != 0)
@ -2424,6 +2426,9 @@ do_ssh2_kex(struct ssh *ssh)
(r = ssh_packet_write_wait(ssh)) != 0) (r = ssh_packet_write_wait(ssh)) != 0)
fatal_fr(r, "send test"); fatal_fr(r, "send test");
#endif #endif
free(prop_kex);
free(prop_enc);
free(prop_hostkey);
debug("KEX done"); debug("KEX done");
} }