openssh-7.3_p1-NEWKEYS_null_deref.patch 857 B

123456789101112131415161718192021222324252627282930
  1. https://bugs.gentoo.org/595342
  2. Backport of
  3. https://anongit.mindrot.org/openssh.git/patch/?id=28652bca29046f62c7045e933e6b931de1d16737
  4. --- openssh-7.3p1/kex.c
  5. +++ openssh-7.3p1/kex.c
  6. @@ -419,6 +419,8 @@
  7. ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
  8. if ((r = sshpkt_get_end(ssh)) != 0)
  9. return r;
  10. + if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
  11. + return r;
  12. kex->done = 1;
  13. sshbuf_reset(kex->peer);
  14. /* sshbuf_reset(kex->my); */
  15. --- openssh-7.3p1/packet.c
  16. +++ openssh-7.3p1/packet.c
  17. @@ -1919,9 +1919,7 @@
  18. return r;
  19. return SSH_ERR_PROTOCOL_ERROR;
  20. }
  21. - if (*typep == SSH2_MSG_NEWKEYS)
  22. - r = ssh_set_newkeys(ssh, MODE_IN);
  23. - else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
  24. + if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
  25. r = ssh_packet_enable_delayed_compress(ssh);
  26. else
  27. r = 0;