From 71708e34a2da9bce144c5a7858ed9b686e33c22d Mon Sep 17 00:00:00 2001
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Date: Mon, 27 Mar 2006 13:03:55 +0000
Subject: use strtonum() instead of atoi(), limit dhg size to 64k; ok djm

---
 usr.bin/ssh/dh.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'usr.bin')

diff --git a/usr.bin/ssh/dh.c b/usr.bin/ssh/dh.c
index 4db3b0b2a3a..b32a7efb556 100644
--- a/usr.bin/ssh/dh.c
+++ b/usr.bin/ssh/dh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.c,v 1.34 2006/03/25 13:17:01 djm Exp $ */
+/* $OpenBSD: dh.c,v 1.35 2006/03/27 13:03:54 deraadt Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  *
@@ -44,6 +44,7 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
 {
 	char *cp, *arg;
 	char *strsize, *gen, *prime;
+	const char *errstr = NULL;
 
 	cp = line;
 	if ((arg = strdelim(&cp)) == NULL)
@@ -68,7 +69,8 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
 		goto fail;
 	strsize = strsep(&cp, " "); /* size */
 	if (cp == NULL || *strsize == '\0' ||
-	    (dhg->size = atoi(strsize)) == 0)
+	    (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 ||
+	    errstr)
 		goto fail;
 	/* The whole group is one bit larger */
 	dhg->size++;
-- 
cgit v1.2.3