git.tremily.us Git - gentoo.git/blob

   1 https://github.com/openssh/openssh-portable/commit/29e0ecd9b4eb3b9f305e2240351f0c59cad9ef81
   2
   3 --- a/sshkey.c
   4 +++ b/sshkey.c
   5 @@ -3209,6 +3209,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
   6                 if ((r = sshkey_froms(buf, &k)) != 0 ||
   7                     (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
   8                         goto out;
   9 +               if (k->type != type) {
  10 +                       r = SSH_ERR_INVALID_FORMAT;
  11 +                       goto out;
  12 +               }
  13                 if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) {
  14                         r = SSH_ERR_LIBCRYPTO_ERROR;
  15                         goto out;
  16 @@ -3252,6 +3256,11 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
  17                 if ((r = sshkey_froms(buf, &k)) != 0 ||
  18                     (r = sshbuf_get_bignum2(buf, &exponent)) != 0)
  19                         goto out;
  20 +               if (k->type != type ||
  21 +                   k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) {
  22 +                       r = SSH_ERR_INVALID_FORMAT;
  23 +                       goto out;
  24 +               }
  25                 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
  26                         r = SSH_ERR_LIBCRYPTO_ERROR;
  27                         goto out;
  28 @@ -3296,6 +3305,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
  29                     (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 ||
  30                     (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0)
  31                         goto out;
  32 +               if (k->type != type) {
  33 +                       r = SSH_ERR_INVALID_FORMAT;
  34 +                       goto out;
  35 +               }
  36                 if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) {
  37                         r = SSH_ERR_LIBCRYPTO_ERROR;
  38                         goto out;
  39 @@ -3333,13 +3346,17 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
  40                     (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
  41                     (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
  42                         goto out;
  43 +               if (k->type != type) {
  44 +                       r = SSH_ERR_INVALID_FORMAT;
  45 +                       goto out;
  46 +               }
  47                 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
  48                         r = SSH_ERR_INVALID_FORMAT;
  49                         goto out;
  50                 }
  51                 k->ed25519_pk = ed25519_pk;
  52                 k->ed25519_sk = ed25519_sk;
  53 -               ed25519_pk = ed25519_sk = NULL;
  54 +               ed25519_pk = ed25519_sk = NULL; /* transferred */
  55                 break;
  56  #ifdef WITH_XMSS
  57         case KEY_XMSS:
  58 @@ -3370,7 +3387,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
  59                     (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
  60                     (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0)
  61                         goto out;
  62 -               if (strcmp(xmss_name, k->xmss_name)) {
  63 +               if (k->type != type || strcmp(xmss_name, k->xmss_name) != 0) {
  64                         r = SSH_ERR_INVALID_FORMAT;
  65                         goto out;
  66                 }
  67 @@ -3877,7 +3894,8 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
  68         }
  69
  70         /* check that an appropriate amount of auth data is present */
  71 -       if (sshbuf_len(decoded) < encrypted_len + authlen) {
  72 +       if (sshbuf_len(decoded) < authlen ||
  73 +           sshbuf_len(decoded) - authlen < encrypted_len) {
  74                 r = SSH_ERR_INVALID_FORMAT;
  75                 goto out;
  76         }