RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-12-26 20:02:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: fix integer overflow in XMSS private key parsing.

Browse Source 
Reported by Adam Zabrocki via SecuriTeam's SSH program.

Note that this code is experimental and not compiled by default.

ok markus@

OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1
This commit is contained in:
djm@openbsd.org 2019-10-09 00:02:57 +00:00 committed by Damien Miller
parent c2cc25480b
commit a546b17bba
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sshkey-xmss.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshkey-xmss.c,v 1.5 2019/06/28 13:35:04 deraadt Exp $ */
/* $OpenBSD: sshkey-xmss.c,v 1.6 2019/10/09 00:02:57 djm Exp $ */
/*
* Copyright (c) 2017 Markus Friedl. All rights reserved.
*
@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded,
goto out;
}
/* check that an appropriate amount of auth data is present */
if (sshbuf_len(encoded) < encrypted_len + authlen) {
if (sshbuf_len(encoded) < authlen ||
sshbuf_len(encoded) - authlen < encrypted_len) {
r = SSH_ERR_INVALID_FORMAT;
goto out;
}