gh-mirrors/openwrt-packages
1
0
Fork 0
mirror of https://github.com/openwrt/packages.git synced 2026-01-10 11:44:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

openssh: move inbound NEWKEYS handling to kex layer; otherwise early NEWKEYS causes NULL deref

Browse Source 
see: https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737

Signed-off-by: Peter Wagner <tripolar@gmx.at>
This commit is contained in:
Peter Wagner
2016-10-03 21:38:15 +02:00
parent fbe48e2172
commit c67b05b269
2 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
net/openssh/patches/100-openssh-7.3_p1-NEWKEYS_null_deref.patch Normal file
View File

@@ -0,0 +1,27 @@
Backport of
https://anongit.mindrot.org/openssh.git/patch/?id=28652bca29046f62c7045e933e6b931de1d16737
--- openssh-7.3p1/kex.c
+++ openssh-7.3p1/kex.c
@@ -419,6 +419,8 @@
ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
if ((r = sshpkt_get_end(ssh)) != 0)
return r;
+ if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
+ return r;
kex->done = 1;
sshbuf_reset(kex->peer);
/* sshbuf_reset(kex->my); */
--- openssh-7.3p1/packet.c
+++ openssh-7.3p1/packet.c
@@ -1919,9 +1919,7 @@
return r;
return SSH_ERR_PROTOCOL_ERROR;
}
- if (*typep == SSH2_MSG_NEWKEYS)
- r = ssh_set_newkeys(ssh, MODE_IN);
- else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
+ if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
r = ssh_packet_enable_delayed_compress(ssh);
else
r = 0;