diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2006-02-12 10:44:19 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2006-02-12 10:44:19 +0000 |
| commit | 989e6dcc727db734ee1e475d59ca2ebdf5953370 (patch) | |
| tree | fff17fd319ed5eed7583aaceb5989bc6d6ea6292 /usr.bin/ssh/readconf.c | |
| parent | d01449c60435161fafb6b96813654ab789f06c15 (diff) | |
raise error when the user specifies a RekeyLimit that is smaller than 16
(the smallest of our cipher's blocksize) or big enough to cause integer
wraparound; ok & feedback dtucker@
Diffstat (limited to 'usr.bin/ssh/readconf.c')
| -rw-r--r-- | usr.bin/ssh/readconf.c | 29 |
1 files changed, 22 insertions, 7 deletions
diff --git a/usr.bin/ssh/readconf.c b/usr.bin/ssh/readconf.c index 6f11e640b9a..6e33cd324dc 100644 --- a/usr.bin/ssh/readconf.c +++ b/usr.bin/ssh/readconf.c @@ -12,7 +12,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: readconf.c,v 1.145 2005/12/08 18:34:11 reyk Exp $"); +RCSID("$OpenBSD: readconf.c,v 1.146 2006/02/12 10:44:18 djm Exp $"); #include "ssh.h" #include "xmalloc.h" @@ -304,7 +304,8 @@ process_config_line(Options *options, const char *host, int *activep) { char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256]; - int opcode, *intptr, value, value2; + int opcode, *intptr, value, value2, scale; + long long orig, val64; size_t len; Forward fwd; @@ -477,22 +478,36 @@ parse_yesnoask: fatal("%.200s line %d: Missing argument.", filename, linenum); if (arg[0] < '0' || arg[0] > '9') fatal("%.200s line %d: Bad number.", filename, linenum); - value = strtol(arg, &endofnumber, 10); + orig = val64 = strtoll(arg, &endofnumber, 10); if (arg == endofnumber) fatal("%.200s line %d: Bad number.", filename, linenum); switch (toupper(*endofnumber)) { + case '\0': + scale = 1; + break; case 'K': - value *= 1<<10; + scale = 1<<10; break; case 'M': - value *= 1<<20; + scale = 1<<20; break; case 'G': - value *= 1<<30; + scale = 1<<30; break; + default: + fatal("%.200s line %d: Invalid RekeyLimit suffix", + filename, linenum); } + val64 *= scale; + /* detect integer wrap and too-large limits */ + if ((val64 / scale) != orig || val64 > INT_MAX) + fatal("%.200s line %d: RekeyLimit too large", + filename, linenum); + if (val64 < 16) + fatal("%.200s line %d: RekeyLimit too small", + filename, linenum); if (*activep && *intptr == -1) - *intptr = value; + *intptr = (int)val64; break; case oIdentityFile: |