diff options
| author | Darren Tucker <dtucker@cvs.openbsd.org> | 2022-06-24 04:37:01 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@cvs.openbsd.org> | 2022-06-24 04:37:01 +0000 |
| commit | df8581f07fdc6c3beb91a7268eaabfd3c8617e7d (patch) | |
| tree | 594516b77d85c22b42549d785fca2360feacfae6 /usr.bin | |
| parent | 9c84864d4581c1f74466fcb01c3b17e74ec2a334 (diff) | |
Don't leak the strings allocated by order_hostkeyalgs() and
list_hostkey_types() that are passed to compat_pkalg_proposal().
Part of github PR#324 from ZoltanFridrich, ok djm@
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ssh/sshconnect2.c | 10 | ||||
| -rw-r--r-- | usr.bin/ssh/sshd.c | 8 |
2 files changed, 12 insertions, 6 deletions
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index 1171e5a08ce..2cd3ef072be 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.356 2022/02/01 23:32:51 djm Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.357 2022/06/24 04:37:00 dtucker Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -109,6 +109,7 @@ first_alg(const char *algs) return ret; } +/* Returns an allocated string that the caller must free. */ static char * order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, const struct ssh_conn_info *cinfo) @@ -212,7 +213,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, const struct ssh_conn_info *cinfo) { char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; - char *s, *all_key; + char *s, *all_key, *hostkeyalgs = NULL; int r, use_known_hosts_order = 0; xxx_host = host; @@ -250,9 +251,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; if (use_known_hosts_order) { /* Query known_hosts and prefer algorithms that appear there */ + hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = - compat_pkalg_proposal(ssh, - order_hostkeyalgs(host, hostaddr, port, cinfo)); + compat_pkalg_proposal(ssh, hostkeyalgs); + free(hostkeyalgs); } else { /* Use specified HostkeyAlgorithms exactly */ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c index d6fbbef7741..f91e04a574e 100644 --- a/usr.bin/ssh/sshd.c +++ b/usr.bin/ssh/sshd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd.c,v 1.586 2022/06/17 01:00:03 dtucker Exp $ */ +/* $OpenBSD: sshd.c,v 1.587 2022/06/24 04:37:00 dtucker Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -560,6 +560,7 @@ append_hostkey_type(struct sshbuf *b, const char *s) fatal_fr(r, "sshbuf_putf"); } +/* Returns an allocated string that the caller must free. */ static char * list_hostkey_types(void) { @@ -2194,6 +2195,7 @@ static void do_ssh2_kex(struct ssh *ssh) { char *myproposal[PROPOSAL_MAX] = { KEX_SERVER }; + char *hostkey_types = NULL; struct kex *kex; int r; @@ -2215,8 +2217,10 @@ do_ssh2_kex(struct ssh *ssh) ssh_packet_set_rekey_limits(ssh, options.rekey_limit, options.rekey_interval); + hostkey_types = list_hostkey_types(); myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( - ssh, list_hostkey_types()); + ssh, hostkey_types); + free(hostkey_types); /* start key exchange */ if ((r = kex_setup(ssh, myproposal)) != 0) |