[openssh-commits] [openssh] 01/02: upstream: NULL deref when using find-principals when matching an

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit eb1f042142fdaba93f6c9560cf6c91ae25f6884a
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Wed Jan 5 04:02:42 2022 +0000

    upstream: NULL deref when using find-principals when matching an
    
    allowed_signers line that contains a namespace restriction, but no
    restriction specified on the command-line; report and fix from Fabian Stelzer
    
    OpenBSD-Commit-ID: 4a201b86afb668c908d1a559c6af456a61f4b145
---
 sshsig.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sshsig.c b/sshsig.c
index 0dbae33a..f8c63f7b 100644
--- a/sshsig.c
+++ b/sshsig.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshsig.c,v 1.26 2021/11/28 07:21:26 djm Exp $ */
+/* $OpenBSD: sshsig.c,v 1.27 2022/01/05 04:02:42 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -921,7 +921,7 @@ check_allowed_keys_line(const char *path, u_long linenum, char *line,
 	}
 
 	/* Check whether options preclude the use of this key */
-	if (sigopts->namespaces != NULL &&
+	if (sigopts->namespaces != NULL && sig_namespace != NULL &&
 	    match_pattern_list(sig_namespace, sigopts->namespaces, 0) != 1) {
 		error("%s:%lu: key is not permitted for use in signature "
 		    "namespace \"%s\"", path, linenum, sig_namespace);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.