[openssh-commits] [openssh] 01/03: upstream: Don't leak the strings allocated by order_hostkeyalgs()

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 646686136c34c2dbf6a01296dfaa9ebee029386d
Author: dtucker at openbsd.org <dtucker at openbsd.org>
Date:   Fri Jun 24 04:37:00 2022 +0000

    upstream: Don't leak the strings allocated by order_hostkeyalgs()
    
    and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of
    github PR#324 from ZoltanFridrich, ok djm@
    
    OpenBSD-Commit-ID: b2f6e5f60f2bba293b831654328a8a0035ef4a1b
---
 sshconnect2.c | 10 ++++++----
 sshd.c        |  8 ++++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/sshconnect2.c b/sshconnect2.c
index b25225e6..583d292b 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.356 2022/02/01 23:32:51 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.357 2022/06/24 04:37:00 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -114,6 +114,7 @@ first_alg(const char *algs)
 	return ret;
 }
 
+/* Returns an allocated string that the caller must free. */
 static char *
 order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
     const struct ssh_conn_info *cinfo)
@@ -217,7 +218,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
     const struct ssh_conn_info *cinfo)
 {
 	char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
-	char *s, *all_key;
+	char *s, *all_key, *hostkeyalgs = NULL;
 	int r, use_known_hosts_order = 0;
 
 	xxx_host = host;
@@ -255,9 +256,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
 	    myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
 	if (use_known_hosts_order) {
 		/* Query known_hosts and prefer algorithms that appear there */
+		hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
-		    compat_pkalg_proposal(ssh,
-		    order_hostkeyalgs(host, hostaddr, port, cinfo));
+		    compat_pkalg_proposal(ssh, hostkeyalgs);
+		free(hostkeyalgs);
 	} else {
 		/* Use specified HostkeyAlgorithms exactly */
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
diff --git a/sshd.c b/sshd.c
index f494cdbb..747ba1f7 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.586 2022/06/17 01:00:03 dtucker Exp $ */
+/* $OpenBSD: sshd.c,v 1.587 2022/06/24 04:37:00 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -603,6 +603,7 @@ append_hostkey_type(struct sshbuf *b, const char *s)
 		fatal_fr(r, "sshbuf_putf");
 }
 
+/* Returns an allocated string that the caller must free. */
 static char *
 list_hostkey_types(void)
 {
@@ -2367,6 +2368,7 @@ static void
 do_ssh2_kex(struct ssh *ssh)
 {
 	char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
+	char *hostkey_types = NULL;
 	struct kex *kex;
 	int r;
 
@@ -2388,8 +2390,10 @@ do_ssh2_kex(struct ssh *ssh)
 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
 		    options.rekey_interval);
 
+	hostkey_types = list_hostkey_types();
 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
-	    ssh, list_hostkey_types());
+	    ssh, hostkey_types);
+	free(hostkey_types);
 
 	/* start key exchange */
 	if ((r = kex_setup(ssh, myproposal)) != 0)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.