summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormarkus@openbsd.org <markus@openbsd.org>2016-09-19 19:02:19 +0000
committerDamien Miller <djm@mindrot.org>2016-09-21 11:03:55 +1000
commit28652bca29046f62c7045e933e6b931de1d16737 (patch)
tree54780f2ea3a511e4b80b9888b0fa20e71418f09e
parent492710894acfcc2f173d14d1d45bd2e688df605d (diff)
upstream commit
move inbound NEWKEYS handling to kex layer; otherwise early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed with & ok djm@ Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f
-rw-r--r--kex.c4
-rw-r--r--packet.c6
2 files changed, 5 insertions, 5 deletions
diff --git a/kex.c b/kex.c
index f4c130f14..8800d4001 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: kex.c,v 1.121 2016/09/12 23:31:27 djm Exp $ */ 1/* $OpenBSD: kex.c,v 1.122 2016/09/19 19:02:19 markus Exp $ */
2/* 2/*
3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * 4 *
@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
425 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error); 425 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
426 if ((r = sshpkt_get_end(ssh)) != 0) 426 if ((r = sshpkt_get_end(ssh)) != 0)
427 return r; 427 return r;
428 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
429 return r;
428 kex->done = 1; 430 kex->done = 1;
429 sshbuf_reset(kex->peer); 431 sshbuf_reset(kex->peer);
430 /* sshbuf_reset(kex->my); */ 432 /* sshbuf_reset(kex->my); */
diff --git a/packet.c b/packet.c
index 711091da7..fb316acbc 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: packet.c,v 1.237 2016/09/12 01:22:38 deraadt Exp $ */ 1/* $OpenBSD: packet.c,v 1.238 2016/09/19 19:02:19 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1907 return r; 1907 return r;
1908 return SSH_ERR_PROTOCOL_ERROR; 1908 return SSH_ERR_PROTOCOL_ERROR;
1909 } 1909 }
1910 if (*typep == SSH2_MSG_NEWKEYS) 1910 if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
1911 r = ssh_set_newkeys(ssh, MODE_IN);
1912 else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
1913 r = ssh_packet_enable_delayed_compress(ssh); 1911 r = ssh_packet_enable_delayed_compress(ssh);
1914 else 1912 else
1915 r = 0; 1913 r = 0;