1 files changed, 22 insertions, 91 deletions

diff --git a/authfile.c b/authfile.c
index 7411b68f6..d09b700d2 100644
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.122 2016/11/25 23:24:45 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.127 2017/07/01 13:50:45 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
@@ -42,7 +42,6 @@
 #include "ssh.h"
 #include "log.h"
 #include "authfile.h"
-#include "rsa.h"
 #include "misc.h"
 #include "atomicio.h"
 #include "sshkey.h"
@@ -100,25 +99,13 @@ sshkey_load_file(int fd, struct sshbuf *blob)
         u_char buf[1024];
         size_t len;
         struct stat st;
-        int r, dontmax = 0;
+        int r;
 
         if (fstat(fd, &st) < 0)
                 return SSH_ERR_SYSTEM_ERROR;
         if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
             st.st_size > MAX_KEY_FILE_SIZE)
                 return SSH_ERR_INVALID_FORMAT;
-        /*
-         * Pre-allocate the buffer used for the key contents and clamp its
-         * maximum size. This ensures that key contents are never leaked via
-         * implicit realloc() in the sshbuf code.
-         */
-        if ((st.st_mode & S_IFREG) == 0 || st.st_size <= 0) {
-                st.st_size = 64*1024; /* 64k should be enough for anyone :) */
-                dontmax = 1;
-        }
-        if ((r = sshbuf_allocate(blob, st.st_size)) != 0 ||
-            (dontmax && (r = sshbuf_set_max_size(blob, st.st_size)) != 0))
-                return r;
         for (;;) {
                 if ((len = atomicio(read, fd, buf, sizeof(buf))) == 0) {
                         if (errno == EPIPE)
@@ -147,35 +134,6 @@ sshkey_load_file(int fd, struct sshbuf *blob)
         return r;
 }
 
-#ifdef WITH_SSH1
-/*
- * Loads the public part of the ssh v1 key file.  Returns NULL if an error was
- * encountered (the file does not exist or is not readable), and the key
- * otherwise.
- */
-static int
-sshkey_load_public_rsa1(int fd, struct sshkey **keyp, char **commentp)
-{
-        struct sshbuf *b = NULL;
-        int r;
-
-        if (keyp != NULL)
-                *keyp = NULL;
-        if (commentp != NULL)
-                *commentp = NULL;
-
-        if ((b = sshbuf_new()) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        if ((r = sshkey_load_file(fd, b)) != 0)
-                goto out;
-        if ((r = sshkey_parse_public_rsa1_fileblob(b, keyp, commentp)) != 0)
-                goto out;
-        r = 0;
- out:
-        sshbuf_free(b);
-        return r;
-}
-#endif /* WITH_SSH1 */
 
 /* XXX remove error() calls from here? */
 int
@@ -345,75 +303,48 @@ sshkey_try_load_public(struct sshkey *k, const char *filename, char **commentp)
         return SSH_ERR_INVALID_FORMAT;
 }
 
-/* load public key from ssh v1 private or any pubkey file */
+/* load public key from any pubkey file */
 int
 sshkey_load_public(const char *filename, struct sshkey **keyp, char **commentp)
 {
         struct sshkey *pub = NULL;
-        char file[PATH_MAX];
-        int r, fd;
+        char *file = NULL;
+        int r;
 
         if (keyp != NULL)
                 *keyp = NULL;
         if (commentp != NULL)
                 *commentp = NULL;
 
-        /* XXX should load file once and attempt to parse each format */
-
-        if ((fd = open(filename, O_RDONLY)) < 0)
-                goto skip;
-#ifdef WITH_SSH1
-        /* try rsa1 private key */
-        r = sshkey_load_public_rsa1(fd, keyp, commentp);
-        close(fd);
-        switch (r) {
-        case SSH_ERR_INTERNAL_ERROR:
-        case SSH_ERR_ALLOC_FAIL:
-        case SSH_ERR_INVALID_ARGUMENT:
-        case SSH_ERR_SYSTEM_ERROR:
-        case 0:
-                return r;
-        }
-#else /* WITH_SSH1 */
-        close(fd);
-#endif /* WITH_SSH1 */
-
-        /* try ssh2 public key */
         if ((pub = sshkey_new(KEY_UNSPEC)) == NULL)
                 return SSH_ERR_ALLOC_FAIL;
         if ((r = sshkey_try_load_public(pub, filename, commentp)) == 0) {
-                if (keyp != NULL)
-                        *keyp = pub;
-                return 0;
-        }
-        sshkey_free(pub);
-
-#ifdef WITH_SSH1
-        /* try rsa1 public key */
-        if ((pub = sshkey_new(KEY_RSA1)) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        if ((r = sshkey_try_load_public(pub, filename, commentp)) == 0) {
-                if (keyp != NULL)
+                if (keyp != NULL) {
                         *keyp = pub;
-                return 0;
+                        pub = NULL;
+                }
+                r = 0;
+                goto out;
         }
         sshkey_free(pub);
-#endif /* WITH_SSH1 */
 
- skip:
         /* try .pub suffix */
-        if ((pub = sshkey_new(KEY_UNSPEC)) == NULL)
+        if (asprintf(&file, "%s.pub", filename) == -1)
                 return SSH_ERR_ALLOC_FAIL;
-        r = SSH_ERR_ALLOC_FAIL; /* in case strlcpy or strlcat fail */
-        if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
-            (strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
-            (r = sshkey_try_load_public(pub, file, commentp)) == 0) {
-                if (keyp != NULL)
+        if ((pub = sshkey_new(KEY_UNSPEC)) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+        if ((r = sshkey_try_load_public(pub, file, commentp)) == 0) {
+                if (keyp != NULL) {
                         *keyp = pub;
-                return 0;
+                        pub = NULL;
+                }
+                r = 0;
         }
+ out:
+        free(file);
         sshkey_free(pub);
-
         return r;
 }