Debian release 3.6p1-1.

1 files changed, 26 insertions, 16 deletions

diff --git a/monitor.c b/monitor.c
index 4ad3f3d21..3d7dcaf86 100644
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.29 2002/09/26 11:38:43 markus Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.34 2003/03/23 19:02:00 markus Exp $");
 
 #include <openssl/dh.h>
 
@@ -634,20 +634,20 @@ mm_answer_bsdauthquery(int socket, Buffer *m)
         u_int numprompts;
         u_int *echo_on;
         char **prompts;
-        int res;
+        u_int success;
 
-        res = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
-            &prompts, &echo_on);
+        success = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
+            &prompts, &echo_on) < 0 ? 0 : 1;
 
         buffer_clear(m);
-        buffer_put_int(m, res);
-        if (res != -1)
+        buffer_put_int(m, success);
+        if (success)
                 buffer_put_cstring(m, prompts[0]);
 
-        debug3("%s: sending challenge res: %d", __func__, res);
+        debug3("%s: sending challenge success: %u", __func__, success);
         mm_request_send(socket, MONITOR_ANS_BSDAUTHQUERY, m);
 
-        if (res != -1) {
+        if (success) {
                 xfree(name);
                 xfree(infotxt);
                 xfree(prompts);
@@ -691,16 +691,16 @@ mm_answer_skeyquery(int socket, Buffer *m)
 {
         struct skey skey;
         char challenge[1024];
-        int res;
+        u_int success;
 
-        res = skeychallenge(&skey, authctxt->user, challenge);
+        success = skeychallenge(&skey, authctxt->user, challenge) < 0 ? 0 : 1;
 
         buffer_clear(m);
-        buffer_put_int(m, res);
-        if (res != -1)
+        buffer_put_int(m, success);
+        if (success)
                 buffer_put_cstring(m, challenge);
 
-        debug3("%s: sending challenge res: %d", __func__, res);
+        debug3("%s: sending challenge success: %u", __func__, success);
         mm_request_send(socket, MONITOR_ANS_SKEYQUERY, m);
 
         return (0);
@@ -806,8 +806,9 @@ mm_answer_keyallowed(int socket, Buffer *m)
                         fatal("%s: unknown key type %d", __func__, type);
                         break;
                 }
-                key_free(key);
         }
+        if (key != NULL)
+                key_free(key);
 
         /* clear temporarily storage (used by verify) */
         monitor_reset_key_state();
@@ -826,6 +827,7 @@ mm_answer_keyallowed(int socket, Buffer *m)
 
         buffer_clear(m);
         buffer_put_int(m, allowed);
+        buffer_put_int(m, forced_command != NULL);
 
         mm_append_debug(m);
 
@@ -1188,6 +1190,7 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m)
         }
         buffer_clear(m);
         buffer_put_int(m, allowed);
+        buffer_put_int(m, forced_command != NULL);
 
         /* clear temporarily storage (used by generate challenge) */
         monitor_reset_key_state();
@@ -1202,8 +1205,9 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m)
                 key_blob = blob;
                 key_bloblen = blen;
                 key_blobtype = MM_RSAUSERKEY;
-                key_free(key);
         }
+        if (key != NULL)
+                key_free(key);
 
         mm_append_debug(m);
 
@@ -1244,6 +1248,9 @@ mm_answer_rsa_challenge(int socket, Buffer *m)
         mm_request_send(socket, MONITOR_ANS_RSACHALLENGE, m);
 
         monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1);
+
+        xfree(blob);
+        key_free(key);
         return (0);
 }
 
@@ -1274,6 +1281,7 @@ mm_answer_rsa_response(int socket, Buffer *m)
                 fatal("%s: received bad response to challenge", __func__);
         success = auth_rsa_verify_response(key, ssh1_challenge, response);
 
+        xfree(blob);
         key_free(key);
         xfree(response);
 
@@ -1458,6 +1466,8 @@ mm_get_kex(Buffer *m)
             (memcmp(kex->session_id, session_id2, session_id2_len) != 0))
                 fatal("mm_get_get: internal error: bad session id");
         kex->we_need = buffer_get_int(m);
+        kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
+        kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->server = 1;
         kex->hostkey_type = buffer_get_int(m);
         kex->kex_type = buffer_get_int(m);
@@ -1551,7 +1561,7 @@ mm_get_keystate(struct monitor *pmonitor)
 void *
 mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
 {
-        size_t len = size * ncount;
+        size_t len = (size_t) size * ncount;
         void *address;
 
         if (len == 0 || ncount > SIZE_T_MAX / size)