summaryrefslogtreecommitdiff
path: root/usr.bin/ssh
diff options
context:
space:
mode:
authorDamien Miller <djm@cvs.openbsd.org>2014-06-24 00:52:03 +0000
committerDamien Miller <djm@cvs.openbsd.org>2014-06-24 00:52:03 +0000
commit2f9dfdb2893849fe0459b7fd6d17c6244c1f6e4b (patch)
treed343e91288d91fd148d8cc06ca82afb05ea37616 /usr.bin/ssh
parentfaae52f9a9b5ff86277080059f6462bd3f18b876 (diff)
fix bug in KRL generation: multiple consecutive revoked certificate
serial number ranges could be serialised to an invalid format. Readers of a broken KRL caused by this bug will fail closed, so no should-have-been-revoked key will be accepted.
Diffstat (limited to 'usr.bin/ssh')
-rw-r--r--usr.bin/ssh/krl.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/usr.bin/ssh/krl.c b/usr.bin/ssh/krl.c
index 2e0d474683d..3106ff2ebbc 100644
--- a/usr.bin/ssh/krl.c
+++ b/usr.bin/ssh/krl.c
@@ -14,7 +14,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $OpenBSD: krl.c,v 1.15 2014/04/28 03:09:18 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.16 2014/06/24 00:52:02 djm Exp $ */
#include <sys/types.h>
#include <sys/param.h>
@@ -573,6 +573,7 @@ revoked_certs_generate(struct revoked_certs *rc, Buffer *buf)
buffer_put_char(buf, state);
buffer_put_string(buf,
buffer_ptr(&sect), buffer_len(&sect));
+ buffer_clear(&sect);
}
/* If we are starting a new section then prepare it now */