From 28652bca29046f62c7045e933e6b931de1d16737 Mon Sep 17 00:00:00 2001

From: "markus@openbsd.org" <markus@openbsd.org>

Date: Mon, 19 Sep 2016 19:02:19 +0000

Subject: upstream commit

move inbound NEWKEYS handling to kex layer; otherwise

early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed

with & ok djm@

Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f

---

 kex.c    | 4 +++-

 packet.c | 6 ++----

 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/kex.c b/kex.c

index f4c130f..8800d40 100644

--- a/kex.c

+++ b/kex.c

@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)

 	ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);

 	if ((r = sshpkt_get_end(ssh)) != 0)

 		return r;

+	if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)

+		return r;

 	kex->done = 1;

 	sshbuf_reset(kex->peer);

 	/* sshbuf_reset(kex->my); */

diff --git a/packet.c b/packet.c

index 711091d..fb316ac 100644

--- a/packet.c

+++ b/packet.c

@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)

 			return r;

 		return SSH_ERR_PROTOCOL_ERROR;

 	}

-	if (*typep == SSH2_MSG_NEWKEYS)

-		r = ssh_set_newkeys(ssh, MODE_IN);

-	else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)

+	if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)

 		r = ssh_packet_enable_delayed_compress(ssh);

 	else

 		r = 0;

-- 

cgit v0.12

0