1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
https://github.com/openssh/openssh-portable/commit/29e0ecd9b4eb3b9f305e2240351f0c59cad9ef81
--- a/sshkey.c
+++ b/sshkey.c
@@ -3209,6 +3209,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
if ((r = sshkey_froms(buf, &k)) != 0 ||
(r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
goto out;
+ if (k->type != type) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) {
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
@@ -3252,6 +3256,11 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
if ((r = sshkey_froms(buf, &k)) != 0 ||
(r = sshbuf_get_bignum2(buf, &exponent)) != 0)
goto out;
+ if (k->type != type ||
+ k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
@@ -3296,6 +3305,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
(r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 ||
(r = sshbuf_get_bignum2(buf, &rsa_q)) != 0)
goto out;
+ if (k->type != type) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) {
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
@@ -3333,13 +3346,17 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
(r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
(r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
goto out;
+ if (k->type != type) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
r = SSH_ERR_INVALID_FORMAT;
goto out;
}
k->ed25519_pk = ed25519_pk;
k->ed25519_sk = ed25519_sk;
- ed25519_pk = ed25519_sk = NULL;
+ ed25519_pk = ed25519_sk = NULL; /* transferred */
break;
#ifdef WITH_XMSS
case KEY_XMSS:
@@ -3370,7 +3387,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
(r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
(r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0)
goto out;
- if (strcmp(xmss_name, k->xmss_name)) {
+ if (k->type != type || strcmp(xmss_name, k->xmss_name) != 0) {
r = SSH_ERR_INVALID_FORMAT;
goto out;
}
@@ -3877,7 +3894,8 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
}
/* check that an appropriate amount of auth data is present */
- if (sshbuf_len(decoded) < encrypted_len + authlen) {
+ if (sshbuf_len(decoded) < authlen ||
+ sshbuf_len(decoded) - authlen < encrypted_len) {
r = SSH_ERR_INVALID_FORMAT;
goto out;
}
|
GitWeb
