diff options
| author | Darren Tucker <dtucker@cvs.openbsd.org> | 2016-06-01 04:19:50 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@cvs.openbsd.org> | 2016-06-01 04:19:50 +0000 |
| commit | 279f7f6e4cb8cc4baaf7c8f1ecc527e05d76bb28 (patch) | |
| tree | 3d6453a8d3a3fcf086868a2fe22b7ce281545bb4 /usr.bin/ssh/kexgexs.c | |
| parent | 6761d1fab9d9a9de5ccb577e156eaad74c8ed28d (diff) | |
Check min and max sizes sent by the client against what we support before
passing them to the monitor. ok djm@
Diffstat (limited to 'usr.bin/ssh/kexgexs.c')
| -rw-r--r-- | usr.bin/ssh/kexgexs.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/usr.bin/ssh/kexgexs.c b/usr.bin/ssh/kexgexs.c index b0740885e17..faea39a70a1 100644 --- a/usr.bin/ssh/kexgexs.c +++ b/usr.bin/ssh/kexgexs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexgexs.c,v 1.27 2016/05/31 23:46:14 dtucker Exp $ */ +/* $OpenBSD: kexgexs.c,v 1.28 2016/06/01 04:19:49 dtucker Exp $ */ /* * Copyright (c) 2000 Niels Provos. All rights reserved. * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -78,21 +78,21 @@ input_kex_dh_gex_request(int type, u_int32_t seq, void *ctxt) kex->nbits = nbits; kex->min = min; kex->max = max; - min = MAX(DH_GRP_MIN, min); - max = MIN(DH_GRP_MAX, max); - nbits = MAX(DH_GRP_MIN, nbits); - nbits = MIN(DH_GRP_MAX, nbits); - if (kex->max < kex->min || kex->nbits < kex->min || - kex->max < kex->nbits || kex->max < DH_GRP_MIN) { + kex->max < kex->nbits || kex->max < DH_GRP_MIN || + kex->min > DH_GRP_MAX) { r = SSH_ERR_DH_GEX_OUT_OF_RANGE; goto out; } + kex->min = MAX(DH_GRP_MIN, kex->min); + kex->max = MIN(DH_GRP_MAX, kex->max); + kex->nbits = MAX(DH_GRP_MIN, kex->nbits); + kex->nbits = MIN(DH_GRP_MAX, kex->nbits); /* Contact privileged parent */ - kex->dh = PRIVSEP(choose_dh(min, nbits, max)); + kex->dh = PRIVSEP(choose_dh(kex->min, kex->nbits, kex->max)); if (kex->dh == NULL) { - sshpkt_disconnect(ssh, "no matching DH grp found"); + sshpkt_disconnect(ssh, "no matching DH group found"); r = SSH_ERR_ALLOC_FAIL; goto out; } |