upstream commit

pass negotiated signing algorithm though to
sshkey_verify() and check that the negotiated algorithm matches the type in
the signature (only matters for RSA SHA1/SHA2 sigs). ok markus@

OpenBSD-Commit-ID: 735fb15bf4adc060d3bee9d047a4bcaaa81b1af9

1 files changed, 2 insertions, 2 deletions

diff --git a/krl.c b/krl.c
index 086fc20e5..379153247 100644
--- a/krl.c
+++ b/krl.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $OpenBSD: krl.c,v 1.40 2017/05/31 09:15:42 deraadt Exp $ */
+/* $OpenBSD: krl.c,v 1.41 2017/12/18 02:25:15 djm Exp $ */
 
 #include "includes.h"
 
@@ -1014,7 +1014,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
                 }
                 /* Check signature over entire KRL up to this point */
                 if ((r = sshkey_verify(key, blob, blen,
-                    sshbuf_ptr(buf), sig_off, 0)) != 0)
+                    sshbuf_ptr(buf), sig_off, NULL, 0)) != 0)
                         goto out;
                 /* Check if this key has already signed this KRL */
                 for (i = 0; i < nca_used; i++) {