RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: Don't log NULL hostname in restricted agent code, 

printf("%s", NULL) is not safe on all platforms.  with & ok djm

OpenBSD-Commit-ID: faf10cdae4adde00cdd668cd1f6e05d0a0e32a02
This commit is contained in:
dtucker@openbsd.org 2022-01-12 03:30:32 +00:00 committed by Darren Tucker
parent acabefe3f8
commit 72bcd7993d
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ssh-agent.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-agent.c,v 1.285 2022/01/01 04:18:06 djm Exp $ */ /* $OpenBSD: ssh-agent.c,v 1.286 2022/01/12 03:30:32 dtucker Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -263,6 +263,7 @@ match_key_hop(const char *tag, const struct sshkey *key,
const struct dest_constraint_hop *dch) const struct dest_constraint_hop *dch)
{ {
const char *reason = NULL; const char *reason = NULL;
const char *hostname = dch->hostname ? dch->hostname : "(ORIGIN)";
u_int i; u_int i;
char *fp; char *fp;
@ -273,7 +274,7 @@ match_key_hop(const char *tag, const struct sshkey *key,
SSH_FP_DEFAULT)) == NULL) SSH_FP_DEFAULT)) == NULL)
fatal_f("fingerprint failed"); fatal_f("fingerprint failed");
debug3_f("%s: entering hostname %s, requested key %s %s, %u keys avail", debug3_f("%s: entering hostname %s, requested key %s %s, %u keys avail",
tag, dch->hostname, sshkey_type(key), fp, dch->nkeys); tag, hostname, sshkey_type(key), fp, dch->nkeys);
free(fp); free(fp);
for (i = 0; i < dch->nkeys; i++) { for (i = 0; i < dch->nkeys; i++) {
if (dch->keys[i] == NULL) if (dch->keys[i] == NULL)
@ -300,10 +301,10 @@ match_key_hop(const char *tag, const struct sshkey *key,
return -1; /* shouldn't happen */ return -1; /* shouldn't happen */
if (!sshkey_equal(key->cert->signature_key, dch->keys[i])) if (!sshkey_equal(key->cert->signature_key, dch->keys[i]))
continue; continue;
if (sshkey_cert_check_host(key, dch->hostname, 1, if (sshkey_cert_check_host(key, hostname, 1,
SSH_ALLOWED_CA_SIGALGS, &reason) != 0) { SSH_ALLOWED_CA_SIGALGS, &reason) != 0) {
debug_f("cert %s / hostname %s rejected: %s", debug_f("cert %s / hostname %s rejected: %s",
key->cert->key_id, dch->hostname, reason); key->cert->key_id, hostname, reason);
continue; continue;
} }
return 0; return 0;