diff options
Diffstat (limited to 'ssh-pkcs11.c')
-rw-r--r-- | ssh-pkcs11.c | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c index e074175bb..92614a52d 100644 --- a/ssh-pkcs11.c +++ b/ssh-pkcs11.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh-pkcs11.c,v 1.19 2015/05/27 05:15:02 djm Exp $ */ | 1 | /* $OpenBSD: ssh-pkcs11.c,v 1.21 2015/07/18 08:02:17 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2010 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2010 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -481,15 +481,23 @@ pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx, | |||
481 | error("C_GetAttributeValue failed: %lu", rv); | 481 | error("C_GetAttributeValue failed: %lu", rv); |
482 | continue; | 482 | continue; |
483 | } | 483 | } |
484 | /* check that none of the attributes are zero length */ | 484 | /* |
485 | if (attribs[0].ulValueLen == 0 || | 485 | * Allow CKA_ID (always first attribute) to be empty, but |
486 | attribs[1].ulValueLen == 0 || | 486 | * ensure that none of the others are zero length. |
487 | * XXX assumes CKA_ID is always first. | ||
488 | */ | ||
489 | if (attribs[1].ulValueLen == 0 || | ||
487 | attribs[2].ulValueLen == 0) { | 490 | attribs[2].ulValueLen == 0) { |
488 | continue; | 491 | continue; |
489 | } | 492 | } |
490 | /* allocate buffers for attributes */ | 493 | /* allocate buffers for attributes */ |
491 | for (i = 0; i < 3; i++) | 494 | for (i = 0; i < 3; i++) { |
492 | attribs[i].pValue = xmalloc(attribs[i].ulValueLen); | 495 | if (attribs[i].ulValueLen > 0) { |
496 | attribs[i].pValue = xmalloc( | ||
497 | attribs[i].ulValueLen); | ||
498 | } | ||
499 | } | ||
500 | |||
493 | /* | 501 | /* |
494 | * retrieve ID, modulus and public exponent of RSA key, | 502 | * retrieve ID, modulus and public exponent of RSA key, |
495 | * or ID, subject and value for certificates. | 503 | * or ID, subject and value for certificates. |
@@ -631,6 +639,11 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp) | |||
631 | error("C_GetTokenInfo failed: %lu", rv); | 639 | error("C_GetTokenInfo failed: %lu", rv); |
632 | continue; | 640 | continue; |
633 | } | 641 | } |
642 | if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) { | ||
643 | debug2("%s: ignoring uninitialised token in slot %lu", | ||
644 | __func__, (unsigned long)i); | ||
645 | continue; | ||
646 | } | ||
634 | rmspace(token->label, sizeof(token->label)); | 647 | rmspace(token->label, sizeof(token->label)); |
635 | rmspace(token->manufacturerID, sizeof(token->manufacturerID)); | 648 | rmspace(token->manufacturerID, sizeof(token->manufacturerID)); |
636 | rmspace(token->model, sizeof(token->model)); | 649 | rmspace(token->model, sizeof(token->model)); |