From 1736df6af1a535c5a9731972f0d6dfb6e8ddac4f Mon Sep 17 00:00:00 2001
From: Markus Friedl <markus@cvs.openbsd.org>
Date: Tue, 19 Sep 2006 21:14:09 +0000
Subject: client NULL deref on protocol error; Tavis Ormandy, Google Security
 Team

---
 usr.bin/ssh/packet.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'usr.bin')

diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c
index 278948c8351..1f0fabd7607 100644
--- a/usr.bin/ssh/packet.c
+++ b/usr.bin/ssh/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.144 2006/09/16 19:53:37 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.145 2006/09/19 21:14:08 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -682,6 +682,9 @@ packet_enable_delayed_compress(void)
 	 */
 	after_authentication = 1;
 	for (mode = 0; mode < MODE_MAX; mode++) {
+		/* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
+		if (newkeys[mode] == NULL)
+			continue;
 		comp = &newkeys[mode]->comp;
 		if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
 			packet_init_compression();
-- 
cgit v1.2.3