- djm@cvs.openbsd.org 2013/12/02 02:56:17

     [ssh-pkcs11-helper.c]
     use-after-free; bz#2175 patch from Loganaden Velvindron @ AfriNIC

2 files changed, 6 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 1aa9e80e1..ef9ad8515 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -26,6 +26,9 @@
    - djm@cvs.openbsd.org 2013/12/02 02:50:27
      [PROTOCOL.chacha20poly1305]
      typo; from Jon Cave
+   - djm@cvs.openbsd.org 2013/12/02 02:56:17
+     [ssh-pkcs11-helper.c]
+     use-after-free; bz#2175 patch from Loganaden Velvindron @ AfriNIC
 
 20131121
  - (djm) OpenBSD CVS Sync
diff --git a/ssh-pkcs11-helper.c b/ssh-pkcs11-helper.c
index 39b2e7c56..b7c52beb8 100644
--- a/ssh-pkcs11-helper.c
+++ b/ssh-pkcs11-helper.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-helper.c,v 1.6 2013/05/17 00:13:14 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11-helper.c,v 1.7 2013/12/02 02:56:17 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  *
@@ -127,7 +127,8 @@ process_add(void)
                 buffer_put_char(&msg, SSH2_AGENT_IDENTITIES_ANSWER);
                 buffer_put_int(&msg, nkeys);
                 for (i = 0; i < nkeys; i++) {
-                        key_to_blob(keys[i], &blob, &blen);
+                        if (key_to_blob(keys[i], &blob, &blen) == 0)
+                                continue;
                         buffer_put_string(&msg, blob, blen);
                         buffer_put_cstring(&msg, name);
                         free(blob);