From ae831ab30526bf00d1141c7cb8ec5b735d23c419 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Sep 29 2016 09:15:13 +0000
Subject: Fix NULL derefence (#1380297)

https://anongit.mindrot.org/openssh.git/patch/?id=28652bca29046f62c7045e933e6b931de1d16737

---

diff --git a/openssh-7.3p1-null-deref.patch b/openssh-7.3p1-null-deref.patch
new file mode 100644
index 0000000..041ae78
--- /dev/null
+++ b/openssh-7.3p1-null-deref.patch
@@ -0,0 +1,48 @@
+From 28652bca29046f62c7045e933e6b931de1d16737 Mon Sep 17 00:00:00 2001
+From: "markus@openbsd.org" <markus@openbsd.org>
+Date: Mon, 19 Sep 2016 19:02:19 +0000
+Subject: upstream commit
+
+move inbound NEWKEYS handling to kex layer; otherwise
+early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed
+with & ok djm@
+
+Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f
+---
+ kex.c    | 4 +++-
+ packet.c | 6 ++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kex.c b/kex.c
+index f4c130f..8800d40 100644
+--- a/kex.c
++++ b/kex.c
+@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
+ 	ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
+ 	if ((r = sshpkt_get_end(ssh)) != 0)
+ 		return r;
++	if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
++		return r;
+ 	kex->done = 1;
+ 	sshbuf_reset(kex->peer);
+ 	/* sshbuf_reset(kex->my); */
+diff --git a/packet.c b/packet.c
+index 711091d..fb316ac 100644
+--- a/packet.c
++++ b/packet.c
+@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ 			return r;
+ 		return SSH_ERR_PROTOCOL_ERROR;
+ 	}
+-	if (*typep == SSH2_MSG_NEWKEYS)
+-		r = ssh_set_newkeys(ssh, MODE_IN);
+-	else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
++	if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
+ 		r = ssh_packet_enable_delayed_compress(ssh);
+ 	else
+ 		r = 0;
+-- 
+cgit v0.12
+
+0
+
diff --git a/openssh.spec b/openssh.spec
index 9401abe..ee20616 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -221,6 +221,8 @@ Patch939: openssh-7.2p2-s390-closefrom.patch
 Patch940: openssh-7.2p2-expose-pam.patch
 # Rework SELinux context handling with chroot (#1357860)
 Patch942: openssh-7.2p2-chroot-capabilities.patch
+# Null dereference in newkeys code (#1380297)
+Patch943: openssh-7.3p1-null-deref.patch
 
 
 License: BSD
@@ -452,6 +454,7 @@ popd
 %patch939 -p1 -b .s390-dev
 %patch940 -p1 -b .expose-pam
 %patch942 -p1 -b .chroot-cap
+%patch943 -p1 -b .deref
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race