From f5ba5db64fa4b1bc1bcb6b5f47b59483c3a529bf Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Tue, 9 Jul 2019 04:15:01 +0000 Subject: cap the number of permiopen/permitlisten directives we're willing to parse on a single authorized_keys line; ok deraadt@ --- usr.bin/ssh/auth-options.c | 4 ++-- usr.bin/ssh/auth-options.h | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) (limited to 'usr.bin') diff --git a/usr.bin/ssh/auth-options.c b/usr.bin/ssh/auth-options.c index 6f8475506bc..06f7949c158 100644 --- a/usr.bin/ssh/auth-options.c +++ b/usr.bin/ssh/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.85 2019/06/27 18:03:37 deraadt Exp $ */ +/* $OpenBSD: auth-options.c,v 1.86 2019/07/09 04:15:00 djm Exp $ */ /* * Copyright (c) 2018 Damien Miller * @@ -317,7 +317,7 @@ handle_permit(const char **optsp, int allow_bare_port, size_t npermits = *npermitsp; const char *errstr = "unknown error"; - if (npermits > INT_MAX) { + if (npermits > SSH_AUTHOPT_PERMIT_MAX) { *errstrp = "too many permission directives"; return -1; } diff --git a/usr.bin/ssh/auth-options.h b/usr.bin/ssh/auth-options.h index 0462983b5d8..14cbfa49dc7 100644 --- a/usr.bin/ssh/auth-options.h +++ b/usr.bin/ssh/auth-options.h @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.h,v 1.27 2018/06/06 18:23:32 djm Exp $ */ +/* $OpenBSD: auth-options.h,v 1.28 2019/07/09 04:15:00 djm Exp $ */ /* * Copyright (c) 2018 Damien Miller @@ -22,6 +22,9 @@ struct passwd; struct sshkey; +/* Maximum number of permitopen/permitlisten directives to accept */ +#define SSH_AUTHOPT_PERMIT_MAX 4096 + /* * sshauthopt represents key options parsed from authorized_keys or * from certificate extensions/options. -- cgit v1.2.3