[openssh-commits] [openssh] 03/03: upstream commit

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 28652bca29046f62c7045e933e6b931de1d16737
Author: markus at openbsd.org <markus at openbsd.org>
Date:   Mon Sep 19 19:02:19 2016 +0000

    upstream commit
    
    move inbound NEWKEYS handling to kex layer; otherwise
    early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed
    with & ok djm@
    
    Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f
---
 kex.c    | 4 +++-
 packet.c | 6 ++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/kex.c b/kex.c
index f4c130f..8800d40 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.121 2016/09/12 23:31:27 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.122 2016/09/19 19:02:19 markus Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -425,6 +425,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
 	ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
 	if ((r = sshpkt_get_end(ssh)) != 0)
 		return r;
+	if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
+		return r;
 	kex->done = 1;
 	sshbuf_reset(kex->peer);
 	/* sshbuf_reset(kex->my); */
diff --git a/packet.c b/packet.c
index 711091d..fb316ac 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.237 2016/09/12 01:22:38 deraadt Exp $ */
+/* $OpenBSD: packet.c,v 1.238 2016/09/19 19:02:19 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
 			return r;
 		return SSH_ERR_PROTOCOL_ERROR;
 	}
-	if (*typep == SSH2_MSG_NEWKEYS)
-		r = ssh_set_newkeys(ssh, MODE_IN);
-	else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
+	if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
 		r = ssh_packet_enable_delayed_compress(ssh);
 	else
 		r = 0;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.