From eb1f042142fdaba93f6c9560cf6c91ae25f6884a Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Wed, 5 Jan 2022 04:02:42 +0000 Subject: [PATCH] upstream: NULL deref when using find-principals when matching an allowed_signers line that contains a namespace restriction, but no restriction specified on the command-line; report and fix from Fabian Stelzer OpenBSD-Commit-ID: 4a201b86afb668c908d1a559c6af456a61f4b145 --- sshsig.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sshsig.c b/sshsig.c index 0dbae33a5..f8c63f7b4 100644 --- a/sshsig.c +++ b/sshsig.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshsig.c,v 1.26 2021/11/28 07:21:26 djm Exp $ */ +/* $OpenBSD: sshsig.c,v 1.27 2022/01/05 04:02:42 djm Exp $ */ /* * Copyright (c) 2019 Google LLC * @@ -921,7 +921,7 @@ check_allowed_keys_line(const char *path, u_long linenum, char *line, } /* Check whether options preclude the use of this key */ - if (sigopts->namespaces != NULL && + if (sigopts->namespaces != NULL && sig_namespace != NULL && match_pattern_list(sig_namespace, sigopts->namespaces, 0) != 1) { error("%s:%lu: key is not permitted for use in signature " "namespace \"%s\"", path, linenum, sig_namespace);