[openssh-commits] [openssh] 21/87: upstream: avoid fatal() exit of ssh-pkcs11-helper if asked to

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 340865c6e62303d107c0376d54dcd312ef7fc343
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 02:02:22 2026 +0000

    upstream: avoid fatal() exit of ssh-pkcs11-helper if asked to
    
    sign a zero-length ed25519 signature.
    
    Anthropic ANT-2026-D209X7KS
    
    OpenBSD-Commit-ID: aef2188ffd4494b3f8decaa595aef00015a16fd1
---
 ssh-pkcs11.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index bd45ef090..66e5dcaa7 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.78 2026/03/03 09:57:25 dtucker Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.79 2026/10/30 02:02:22 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -744,7 +744,8 @@ pkcs11_sign_ed25519(struct sshkey *key,
 	f = k11->provider->function_list;
 	si = &k11->provider->slotinfo[k11->slotidx];
 
-	xdata = xmalloc(datalen);
+	/* copy data as C_Sign() takes a non-const pointer; datalen may be 0 */
+	xdata = xmalloc(MAXIMUM(datalen, 1));
 	memcpy(xdata, data, datalen);
 	sig = xmalloc(crypto_sign_ed25519_BYTES);
 	slen = crypto_sign_ed25519_BYTES;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.