summaryrefslogtreecommitdiff
path: root/debian/patches/unregister-kexinit.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/unregister-kexinit.patch')
-rw-r--r--debian/patches/unregister-kexinit.patch34
1 files changed, 0 insertions, 34 deletions
diff --git a/debian/patches/unregister-kexinit.patch b/debian/patches/unregister-kexinit.patch
deleted file mode 100644
index 48da43273..000000000
--- a/debian/patches/unregister-kexinit.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From b139635512b1af75e82252c0c71ac66e08b78774 Mon Sep 17 00:00:00 2001
2From: "markus@openbsd.org" <markus@openbsd.org>
3Date: Mon, 10 Oct 2016 19:28:48 +0000
4Subject: upstream commit
5
6Unregister the KEXINIT handler after message has been
7received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
8allocation of up to 128MB -- until the connection is closed. Reported by
9shilei-c at 360.cn
10
11Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05
12
13Origin: https://anongit.mindrot.org/openssh.git/commit/?id=ec165c392ca54317dbe3064a8c200de6531e89ad
14Bug-Debian: https://bugs.debian.org/841884
15Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1384860
16Last-Update: 2016-10-24
17
18Patch-Name: unregister-kexinit.patch
19---
20 kex.c | 1 +
21 1 file changed, 1 insertion(+)
22
23diff --git a/kex.c b/kex.c
24index c17d652..7ab72ba 100644
25--- a/kex.c
26+++ b/kex.c
27@@ -488,6 +488,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
28 if (kex == NULL)
29 return SSH_ERR_INVALID_ARGUMENT;
30
31+ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
32 ptr = sshpkt_ptr(ssh, &dlen);
33 if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
34 return r;