diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2019-10-09 00:04:43 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2019-10-09 00:04:43 +0000 |
| commit | 2ee3c3bf6136be3800294822c5fd5b8ea952f329 (patch) | |
| tree | 76ebceb881847f2b3cfc62ce327d3fa25fbaa77c | |
| parent | 1cd4265dd90008dc8f1251944f3ef61aed264a23 (diff) | |
fix an unreachable integer overflow similar to the XMSS case, and some
other NULL dereferences found by fuzzing.
fix with and ok markus@
| -rw-r--r-- | usr.bin/ssh/sshkey.c | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/usr.bin/ssh/sshkey.c b/usr.bin/ssh/sshkey.c index 3ebc3e32e40..3227730a6bd 100644 --- a/usr.bin/ssh/sshkey.c +++ b/usr.bin/ssh/sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.c,v 1.83 2019/09/06 05:23:55 djm Exp $ */ +/* $OpenBSD: sshkey.c,v 1.84 2019/10/09 00:04:42 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved. @@ -3154,6 +3154,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) if ((r = sshkey_froms(buf, &k)) != 0 || (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) goto out; + if (k->type != type) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; @@ -3196,6 +3200,11 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) if ((r = sshkey_froms(buf, &k)) != 0 || (r = sshbuf_get_bignum2(buf, &exponent)) != 0) goto out; + if (k->type != type || + k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; @@ -3239,6 +3248,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) goto out; + if (k->type != type) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; @@ -3276,13 +3289,17 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) goto out; + if (k->type != type) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { r = SSH_ERR_INVALID_FORMAT; goto out; } k->ed25519_pk = ed25519_pk; k->ed25519_sk = ed25519_sk; - ed25519_pk = ed25519_sk = NULL; + ed25519_pk = ed25519_sk = NULL; /* transferred */ break; #ifdef WITH_XMSS case KEY_XMSS: @@ -3313,7 +3330,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) goto out; - if (strcmp(xmss_name, k->xmss_name)) { + if (k->type != type || strcmp(xmss_name, k->xmss_name) != 0) { r = SSH_ERR_INVALID_FORMAT; goto out; } @@ -3820,7 +3837,8 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, } /* check that an appropriate amount of auth data is present */ - if (sshbuf_len(decoded) < encrypted_len + authlen) { + if (sshbuf_len(decoded) < authlen || + sshbuf_len(decoded) - authlen < encrypted_len) { r = SSH_ERR_INVALID_FORMAT; goto out; } |