1 files changed, 11 insertions, 5 deletions

diff --git a/authfile.c b/authfile.c
index 83ddd635f..305e9473b 100644
--- a/authfile.c
+++ b/authfile.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.55 2003/09/18 07:56:05 markus Exp $");
+RCSID("$OpenBSD: authfile.c,v 1.56 2004/05/11 19:01:43 deraadt Exp $");
 
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -236,14 +236,16 @@ key_load_public_rsa1(int fd, const char *filename, char **commentp)
         struct stat st;
         char *cp;
         int i;
-        off_t len;
+        size_t len;
 
         if (fstat(fd, &st) < 0) {
                 error("fstat for key file %.200s failed: %.100s",
                     filename, strerror(errno));
                 return NULL;
         }
-        len = st.st_size;
+        if (st.st_size > 1*1024*1024)
+                close(fd);
+        len = (size_t)st.st_size;               /* truncated */
 
         buffer_init(&buffer);
         cp = buffer_append_space(&buffer, len);
@@ -318,7 +320,7 @@ key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
     char **commentp)
 {
         int i, check1, check2, cipher_type;
-        off_t len;
+        size_t len;
         Buffer buffer, decrypted;
         u_char *cp;
         CipherContext ciphercontext;
@@ -332,7 +334,11 @@ key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
                 close(fd);
                 return NULL;
         }
-        len = st.st_size;
+        if (st.st_size > 1*1024*1024) {
+                close(fd);
+                return (NULL);
+        }
+        len = (size_t)st.st_size;               /* truncated */
 
         buffer_init(&buffer);
         cp = buffer_append_space(&buffer, len);