3 files changed, 25 insertions, 16 deletions

diff --git a/auth2-gss.c b/auth2-gss.c
index fd411d3a7..88bc3ae7b 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -104,9 +104,6 @@ userauth_gssapi(struct ssh *ssh)
         u_int len;
         u_char *doid = NULL;
 
-        if (!authctxt->valid || authctxt->user == NULL)
-                return (0);
-
         mechs = packet_get_int();
         if (mechs == 0) {
                 debug("Mechanism negotiation is not supported");
@@ -137,6 +134,12 @@ userauth_gssapi(struct ssh *ssh)
                 return (0);
         }
 
+        if (!authctxt->valid || authctxt->user == NULL) {
+                debug2("%s: disabled because of invalid user", __func__);
+                free(doid);
+                return (0);
+        }
+
         if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
                 if (ctxt != NULL)
                         ssh_gssapi_delete_ctx(&ctxt);
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 8996f7e05..82a7dcdae 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -67,10 +67,6 @@ userauth_hostbased(struct ssh *ssh)
         size_t alen, blen, slen;
         int r, pktype, authenticated = 0;
 
-        if (!authctxt->valid) {
-                debug2("%s: disabled because of invalid user", __func__);
-                return 0;
-        }
         /* XXX use sshkey_froms() */
         if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 ||
             (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 ||
@@ -118,6 +114,11 @@ userauth_hostbased(struct ssh *ssh)
                 goto done;
         }
 
+        if (!authctxt->valid || authctxt->user == NULL) {
+                debug2("%s: disabled because of invalid user", __func__);
+                goto done;
+        }
+
         if ((b = sshbuf_new()) == NULL)
                 fatal("%s: sshbuf_new failed", __func__);
         /* reconstruct packet */
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 8024b1d6a..a9272b97f 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -89,19 +89,15 @@ userauth_pubkey(struct ssh *ssh)
 {
         Authctxt *authctxt = ssh->authctxt;
         struct passwd *pw = authctxt->pw;
-        struct sshbuf *b;
+        struct sshbuf *b = NULL;
         struct sshkey *key = NULL;
-        char *pkalg, *userstyle = NULL, *key_s = NULL, *ca_s = NULL;
-        u_char *pkblob, *sig, have_sig;
+        char *pkalg = NULL, *userstyle = NULL, *key_s = NULL, *ca_s = NULL;
+        u_char *pkblob = NULL, *sig = NULL, have_sig;
         size_t blen, slen;
         int r, pktype;
         int authenticated = 0;
         struct sshauthopt *authopts = NULL;
 
-        if (!authctxt->valid) {
-                debug2("%s: disabled because of invalid user", __func__);
-                return 0;
-        }
         if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0 ||
             (r = sshpkt_get_cstring(ssh, &pkalg, NULL)) != 0 ||
             (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0)
@@ -168,6 +164,11 @@ userauth_pubkey(struct ssh *ssh)
                                 fatal("%s: sshbuf_put_string session id: %s",
                                     __func__, ssh_err(r));
                 }
+                if (!authctxt->valid || authctxt->user == NULL) {
+                        debug2("%s: disabled because of invalid user",
+                            __func__);
+                        goto done;
+                }
                 /* reconstruct packet */
                 xasprintf(&userstyle, "%s%s%s", authctxt->user,
                     authctxt->style ? ":" : "",
@@ -184,7 +185,6 @@ userauth_pubkey(struct ssh *ssh)
 #ifdef DEBUG_PK
                 sshbuf_dump(b, stderr);
 #endif
-
                 /* test for correct signature */
                 authenticated = 0;
                 if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
@@ -193,7 +193,6 @@ userauth_pubkey(struct ssh *ssh)
                         authenticated = 1;
                 }
                 sshbuf_free(b);
-                free(sig);
                 auth2_record_key(authctxt, authenticated, key);
         } else {
                 debug("%s: test pkalg %s pkblob %s%s%s",
@@ -204,6 +203,11 @@ userauth_pubkey(struct ssh *ssh)
                 if ((r = sshpkt_get_end(ssh)) != 0)
                         fatal("%s: %s", __func__, ssh_err(r));
 
+                if (!authctxt->valid || authctxt->user == NULL) {
+                        debug2("%s: disabled because of invalid user",
+                            __func__);
+                        goto done;
+                }
                 /* XXX fake reply and always send PK_OK ? */
                 /*
                  * XXX this allows testing whether a user is allowed
@@ -237,6 +241,7 @@ done:
         free(pkblob);
         free(key_s);
         free(ca_s);
+        free(sig);
         return authenticated;
 }