[openssh-commits] [openssh] 02/03: upstream commit

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 0882332616e4f0272c31cc47bf2018f9cb258a4e
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri May 22 04:45:52 2015 +0000

    upstream commit
    
    Reorder EscapeChar option parsing to avoid a single-byte
     out- of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
    
    Upstream-ID: 1dc6b5b63d1c8d9a88619da0b27ade461d79b060
---
 readconf.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/readconf.c b/readconf.c
index f40ec8f..47125ae 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.235 2015/05/04 06:10:48 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.236 2015/05/22 04:45:52 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1236,13 +1236,13 @@ parse_int:
 		arg = strdelim(&s);
 		if (!arg || *arg == '\0')
 			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (arg[0] == '^' && arg[2] == 0 &&
+		if (strcmp(arg, "none") == 0)
+			value = SSH_ESCAPECHAR_NONE;
+		else if (arg[1] == '\0')
+			value = (u_char) arg[0];
+		else if (arg[0] == '^' && arg[2] == 0 &&
 		    (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
 			value = (u_char) arg[1] & 31;
-		else if (strlen(arg) == 1)
-			value = (u_char) arg[0];
-		else if (strcmp(arg, "none") == 0)
-			value = SSH_ESCAPECHAR_NONE;
 		else {
 			fatal("%.200s line %d: Bad escape character.",
 			    filename, linenum);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.