4 files changed, 12 insertions, 8 deletions

diff --git a/ssh-dss.c b/ssh-dss.c
index cc47dcf5f..7af59fa6e 100644
--- a/ssh-dss.c
+++ b/ssh-dss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-dss.c,v 1.34 2015/12/11 04:21:12 mmcc Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.35 2016/04/21 06:08:02 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -139,7 +139,8 @@ ssh_dss_verify(const struct sshkey *key,
         char *ktype = NULL;
 
         if (key == NULL || key->dsa == NULL ||
-            sshkey_type_plain(key->type) != KEY_DSA)
+            sshkey_type_plain(key->type) != KEY_DSA ||
+            signature == NULL || signaturelen == 0)
                 return SSH_ERR_INVALID_ARGUMENT;
         if (dlen == 0)
                 return SSH_ERR_INTERNAL_ERROR;
diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
index 74912dfd9..d7bf3c69b 100644
--- a/ssh-ecdsa.c
+++ b/ssh-ecdsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ecdsa.c,v 1.12 2015/12/11 04:21:12 mmcc Exp $ */
+/* $OpenBSD: ssh-ecdsa.c,v 1.13 2016/04/21 06:08:02 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -121,7 +121,8 @@ ssh_ecdsa_verify(const struct sshkey *key,
         char *ktype = NULL;
 
         if (key == NULL || key->ecdsa == NULL ||
-            sshkey_type_plain(key->type) != KEY_ECDSA)
+            sshkey_type_plain(key->type) != KEY_ECDSA ||
+            signature == NULL || signaturelen == 0)
                 return SSH_ERR_INVALID_ARGUMENT;
 
         if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
diff --git a/ssh-ed25519.c b/ssh-ed25519.c
index b159ff5ee..5163e0297 100644
--- a/ssh-ed25519.c
+++ b/ssh-ed25519.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ed25519.c,v 1.6 2015/01/15 21:38:50 markus Exp $ */
+/* $OpenBSD: ssh-ed25519.c,v 1.7 2016/04/21 06:08:02 djm Exp $ */
 /*
  * Copyright (c) 2013 Markus Friedl <markus@openbsd.org>
  *
@@ -107,7 +107,8 @@ ssh_ed25519_verify(const struct sshkey *key,
         if (key == NULL ||
             sshkey_type_plain(key->type) != KEY_ED25519 ||
             key->ed25519_pk == NULL ||
-            datalen >= INT_MAX - crypto_sign_ed25519_BYTES)
+            datalen >= INT_MAX - crypto_sign_ed25519_BYTES ||
+            signature == NULL || signaturelen == 0)
                 return SSH_ERR_INVALID_ARGUMENT;
 
         if ((b = sshbuf_from(signature, signaturelen)) == NULL)
diff --git a/ssh-rsa.c b/ssh-rsa.c
index 53d44d1f3..a6db2a06b 100644
--- a/ssh-rsa.c
+++ b/ssh-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-rsa.c,v 1.58 2015/12/11 04:21:12 mmcc Exp $ */
+/* $OpenBSD: ssh-rsa.c,v 1.59 2016/04/21 06:08:02 djm Exp $ */
 /*
  * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
  *
@@ -172,7 +172,8 @@ ssh_rsa_verify(const struct sshkey *key,
 
         if (key == NULL || key->rsa == NULL ||
             sshkey_type_plain(key->type) != KEY_RSA ||
-            BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
+            BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE ||
+            sig == NULL || siglen == 0)
                 return SSH_ERR_INVALID_ARGUMENT;
 
         if ((b = sshbuf_from(sig, siglen)) == NULL)