131 lines
4.8 KiB
Diff
131 lines
4.8 KiB
Diff
From 6c31ba10e97b6953c4f325f526f3e846dfea647a Mon Sep 17 00:00:00 2001
|
|
From: "dtucker@openbsd.org" <dtucker@openbsd.org>
|
|
Date: Fri, 1 Jul 2022 03:39:44 +0000
|
|
Subject: upstream: Don't leak the strings allocated by order_hostkeyalgs()
|
|
|
|
and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of
|
|
github PR#324 from ZoltanFridrich, ok djm@
|
|
|
|
This is a roll-forward of the previous rollback now that the required
|
|
changes in compat.c have been done.
|
|
|
|
OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb
|
|
|
|
Conflict:NA
|
|
Reference:https://anongit.mindrot.org/openssh.git/patch/?id=6c31ba10e97b6953c4f325f526f3e846dfea647a
|
|
|
|
---
|
|
sshconnect2.c | 16 ++++++++++------
|
|
sshd.c | 17 +++++++++++------
|
|
2 files changed, 21 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/sshconnect2.c b/sshconnect2.c
|
|
index 150d419..eb0df92 100644
|
|
--- a/sshconnect2.c
|
|
+++ b/sshconnect2.c
|
|
@@ -1,4 +1,4 @@
|
|
-/* $OpenBSD: sshconnect2.c,v 1.351 2021/07/23 05:24:02 djm Exp $ */
|
|
+/* $OpenBSD: sshconnect2.c,v 1.359 2022/07/01 03:39:44 dtucker Exp $ */
|
|
/*
|
|
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
|
* Copyright (c) 2008 Damien Miller. All rights reserved.
|
|
@@ -218,6 +218,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
|
|
{
|
|
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
|
|
char *s, *all_key;
|
|
+ char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
|
|
int r, use_known_hosts_order = 0;
|
|
|
|
#if defined(GSSAPI) && defined(WITH_OPENSSL)
|
|
@@ -248,10 +249,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
|
|
|
|
if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
|
|
fatal_f("kex_names_cat");
|
|
- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s);
|
|
+ myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh, s);
|
|
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
|
- compat_cipher_proposal(ssh, options.ciphers);
|
|
- myproposal[PROPOSAL_ENC_ALGS_STOC] =
|
|
+ myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
|
|
compat_cipher_proposal(ssh, options.ciphers);
|
|
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
|
|
myproposal[PROPOSAL_COMP_ALGS_STOC] =
|
|
@@ -260,12 +260,12 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
|
|
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
|
|
if (use_known_hosts_order) {
|
|
/* Query known_hosts and prefer algorithms that appear there */
|
|
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
|
|
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
compat_pkalg_proposal(ssh,
|
|
order_hostkeyalgs(host, hostaddr, port, cinfo));
|
|
} else {
|
|
/* Use specified HostkeyAlgorithms exactly */
|
|
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
|
|
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
compat_pkalg_proposal(ssh, options.hostkeyalgorithms);
|
|
}
|
|
|
|
@@ -380,6 +380,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
|
|
(r = ssh_packet_write_wait(ssh)) != 0)
|
|
fatal_fr(r, "send packet");
|
|
#endif
|
|
+ /* Free only parts of proposal that were dynamically allocated here. */
|
|
+ free(prop_kex);
|
|
+ free(prop_enc);
|
|
+ free(prop_hostkey);
|
|
}
|
|
|
|
/*
|
|
diff --git a/sshd.c b/sshd.c
|
|
index 98a9754..6c77f07 100644
|
|
--- a/sshd.c
|
|
+++ b/sshd.c
|
|
@@ -1,4 +1,4 @@
|
|
-/* $OpenBSD: sshd.c,v 1.578 2021/07/19 02:21:50 dtucker Exp $ */
|
|
+/* $OpenBSD: sshd.c,v 1.589 2022/07/01 03:39:44 dtucker Exp $ */
|
|
/*
|
|
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
|
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
|
@@ -2522,12 +2522,14 @@ do_ssh2_kex(struct ssh *ssh)
|
|
{
|
|
char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
|
|
struct kex *kex;
|
|
+ char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
|
|
int r;
|
|
|
|
- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh,
|
|
+ myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh,
|
|
options.kex_algorithms);
|
|
- myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh,
|
|
- options.ciphers);
|
|
+ myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
|
+ myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
|
|
+ compat_cipher_proposal(ssh, options.ciphers);
|
|
myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh,
|
|
options.ciphers);
|
|
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
|
|
@@ -2542,8 +2544,8 @@ do_ssh2_kex(struct ssh *ssh)
|
|
ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
|
|
options.rekey_interval);
|
|
/* coverity[leaked_storage : FALSE]*/
|
|
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
|
|
- ssh, list_hostkey_types());
|
|
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
+ compat_pkalg_proposal(ssh, list_hostkey_types());
|
|
|
|
#if defined(GSSAPI) && defined(WITH_OPENSSL)
|
|
{
|
|
@@ -2639,6 +2641,9 @@ do_ssh2_kex(struct ssh *ssh)
|
|
(r = ssh_packet_write_wait(ssh)) != 0)
|
|
fatal_fr(r, "send test");
|
|
#endif
|
|
+ free(prop_kex);
|
|
+ free(prop_enc);
|
|
+ free(prop_hostkey);
|
|
debug("KEX done");
|
|
}
|
|
|
|
--
|
|
2.33.0
|
|
|