upstream commit

move inbound NEWKEYS handling to kex layer; otherwise
early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed
with & ok djm@

Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f

1 files changed, 3 insertions, 1 deletions

diff --git a/kex.c b/kex.c
index f4c130f14..8800d4001 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.121 2016/09/12 23:31:27 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.122 2016/09/19 19:02:19 markus Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
         ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
         if ((r = sshpkt_get_end(ssh)) != 0)
                 return r;
+        if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
+                return r;
         kex->done = 1;
         sshbuf_reset(kex->peer);
         /* sshbuf_reset(kex->my); */