New upstream release (8.1p1)

1 files changed, 14 insertions, 7 deletions

diff --git a/ssh-agent.c b/ssh-agent.c
index d06ecfd98..9c6680a25 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.233 2019/01/22 22:58:50 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.237 2019/06/28 13:35:04 deraadt Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -269,6 +269,11 @@ agent_decode_alg(struct sshkey *key, u_int flags)
                         return "rsa-sha2-256";
                 else if (flags & SSH_AGENT_RSA_SHA2_512)
                         return "rsa-sha2-512";
+        } else if (key->type == KEY_RSA_CERT) {
+                if (flags & SSH_AGENT_RSA_SHA2_256)
+                        return "rsa-sha2-256-cert-v01@openssh.com";
+                else if (flags & SSH_AGENT_RSA_SHA2_512)
+                        return "rsa-sha2-512-cert-v01@openssh.com";
         }
         return NULL;
 }
@@ -418,7 +423,10 @@ process_add_identity(SocketEntry *e)
                 error("%s: decode private key: %s", __func__, ssh_err(r));
                 goto err;
         }
-
+        if ((r = sshkey_shield_private(k)) != 0) {
+                error("%s: shield private key: %s", __func__, ssh_err(r));
+                goto err;
+        }
         while (sshbuf_len(e->request)) {
                 if ((r = sshbuf_get_u8(e->request, &ctype)) != 0) {
                         error("%s: buffer error: %s", __func__, ssh_err(r));
@@ -819,11 +827,11 @@ handle_socket_read(u_int socknum)
 
         slen = sizeof(sunaddr);
         fd = accept(sockets[socknum].fd, (struct sockaddr *)&sunaddr, &slen);
-        if (fd < 0) {
+        if (fd == -1) {
                 error("accept from AUTH_SOCKET: %s", strerror(errno));
                 return -1;
         }
-        if (getpeereid(fd, &euid, &egid) < 0) {
+        if (getpeereid(fd, &euid, &egid) == -1) {
                 error("getpeereid %d failed: %s", fd, strerror(errno));
                 close(fd);
                 return -1;
@@ -1096,7 +1104,6 @@ main(int ac, char **av)
         size_t npfd = 0;
         u_int maxfds;
 
-        ssh_malloc_init();      /* must be called before any mallocs */
         /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
         sanitise_stdfd();
 
@@ -1305,7 +1312,7 @@ main(int ac, char **av)
 #ifdef HAVE_SETRLIMIT
         /* deny core dumps, since memory contains unencrypted private keys */
         rlim.rlim_cur = rlim.rlim_max = 0;
-        if (setrlimit(RLIMIT_CORE, &rlim) < 0) {
+        if (setrlimit(RLIMIT_CORE, &rlim) == -1) {
                 error("setrlimit RLIMIT_CORE: %s", strerror(errno));
                 cleanup_exit(1);
         }
@@ -1338,7 +1345,7 @@ skip:
                 if (parent_alive_interval != 0)
                         check_parent_exists();
                 (void) reaper();        /* remove expired keys */
-                if (result < 0) {
+                if (result == -1) {
                         if (saved_errno == EINTR)
                                 continue;
                         fatal("poll: %s", strerror(saved_errno));