[openssh-commits] [openssh] 03/03: upstream: fix ineffective max file size check when loading

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 0875a78bb7228986c2e89ef2f5fe041d2ab27ed7
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Mon Jun 29 09:14:25 2026 +0000

    upstream: fix ineffective max file size check when loading
    
    blobs/keys from files and add another one on a patch that was not covered by
    the existing ones. From Tess Gauthier via bz3969 and bz3970
    
    OpenBSD-Commit-ID: c0dec6c587853349113df85b6dc528dc15079af0
---
 authfile.c  | 8 +++++++-
 sshbuf-io.c | 7 +++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/authfile.c b/authfile.c
index 3f15515c8..954f78c00 100644
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.150 2026/06/14 03:59:34 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.151 2026/06/29 09:14:25 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
@@ -197,6 +197,7 @@ sshkey_try_load_public(struct sshkey **kp, const char *filename,
 	char *line = NULL, *cp;
 	size_t linesize = 0;
 	int r;
+	struct stat st;
 	struct sshkey *k = NULL;
 
 	if (kp == NULL)
@@ -206,6 +207,11 @@ sshkey_try_load_public(struct sshkey **kp, const char *filename,
 		*commentp = NULL;
 	if ((f = fopen(filename, "r")) == NULL)
 		return SSH_ERR_SYSTEM_ERROR;
+	if (stat(filename, &st) == 0 && S_ISREG(st.st_mode) &&
+	    st.st_size > SSHBUF_SIZE_MAX) {
+		fclose(f);
+		return SSH_ERR_INVALID_FORMAT;
+	}
 	if ((k = sshkey_new(KEY_UNSPEC)) == NULL) {
 		fclose(f);
 		return SSH_ERR_ALLOC_FAIL;
diff --git a/sshbuf-io.c b/sshbuf-io.c
index 13ef40e7d..2c1fb4544 100644
--- a/sshbuf-io.c
+++ b/sshbuf-io.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sshbuf-io.c,v 1.2 2020/01/25 23:28:06 djm Exp $ */
+/*	$OpenBSD: sshbuf-io.c,v 1.3 2026/06/29 09:14:25 djm Exp $ */
 /*
  * Copyright (c) 2011 Damien Miller
  *
@@ -43,8 +43,7 @@ sshbuf_load_fd(int fd, struct sshbuf **blobp)
 
 	if (fstat(fd, &st) == -1)
 		return SSH_ERR_SYSTEM_ERROR;
-	if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
-	    st.st_size > SSHBUF_SIZE_MAX)
+	if (S_ISREG(st.st_mode) && st.st_size > SSHBUF_SIZE_MAX)
 		return SSH_ERR_INVALID_FORMAT;
 	if ((blob = sshbuf_new()) == NULL)
 		return SSH_ERR_ALLOC_FAIL;
@@ -62,7 +61,7 @@ sshbuf_load_fd(int fd, struct sshbuf **blobp)
 			goto out;
 		}
 	}
-	if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
+	if (S_ISREG(st.st_mode) == 0 &&
 	    st.st_size != (off_t)sshbuf_len(blob)) {
 		r = SSH_ERR_FILE_CHANGED;
 		goto out;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.