tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: Don't leak the strings allocated by order_hostkeyalgs() 

and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of
github PR#324 from ZoltanFridrich, ok djm@

OpenBSD-Commit-ID: b2f6e5f60f2bba293b831654328a8a0035ef4a1b
This commit is contained in:
dtucker@openbsd.org 2022-06-24 04:37:00 +00:00 committed by Damien Miller
parent 193c6d8d90
commit 646686136c
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sshconnect2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.356 2022/02/01 23:32:51 djm Exp $ */ /* $OpenBSD: sshconnect2.c,v 1.357 2022/06/24 04:37:00 dtucker Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved.
@ -114,6 +114,7 @@ first_alg(const char *algs)
return ret; return ret;
} }
/* Returns an allocated string that the caller must free. */
static char * static char *
order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
const struct ssh_conn_info *cinfo) const struct ssh_conn_info *cinfo)
@ -217,7 +218,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
const struct ssh_conn_info *cinfo) const struct ssh_conn_info *cinfo)
{ {
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
char *s, *all_key; char *s, *all_key, *hostkeyalgs = NULL;
int r, use_known_hosts_order = 0; int r, use_known_hosts_order = 0;
xxx_host = host; xxx_host = host;
@ -255,9 +256,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
if (use_known_hosts_order) { if (use_known_hosts_order) {
/* Query known_hosts and prefer algorithms that appear there */ /* Query known_hosts and prefer algorithms that appear there */
hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
compat_pkalg_proposal(ssh, compat_pkalg_proposal(ssh, hostkeyalgs);
order_hostkeyalgs(host, hostaddr, port, cinfo)); free(hostkeyalgs);
} else { } else {
/* Use specified HostkeyAlgorithms exactly */ /* Use specified HostkeyAlgorithms exactly */
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =

8
sshd.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshd.c,v 1.586 2022/06/17 01:00:03 dtucker Exp $ */ /* $OpenBSD: sshd.c,v 1.587 2022/06/24 04:37:00 dtucker Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -603,6 +603,7 @@ append_hostkey_type(struct sshbuf *b, const char *s)
fatal_fr(r, "sshbuf_putf"); fatal_fr(r, "sshbuf_putf");
} }
/* Returns an allocated string that the caller must free. */
static char * static char *
list_hostkey_types(void) list_hostkey_types(void)
{ {
@ -2367,6 +2368,7 @@ static void
do_ssh2_kex(struct ssh *ssh) do_ssh2_kex(struct ssh *ssh)
{ {
char *myproposal[PROPOSAL_MAX] = { KEX_SERVER }; char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
char *hostkey_types = NULL;
struct kex *kex; struct kex *kex;
int r; int r;
@ -2388,8 +2390,10 @@ do_ssh2_kex(struct ssh *ssh)
ssh_packet_set_rekey_limits(ssh, options.rekey_limit, ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
options.rekey_interval); options.rekey_interval);
hostkey_types = list_hostkey_types();
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
ssh, list_hostkey_types()); ssh, hostkey_types);
free(hostkey_types);
/* start key exchange */ /* start key exchange */
if ((r = kex_setup(ssh, myproposal)) != 0) if ((r = kex_setup(ssh, myproposal)) != 0)