Attachment 2997 Details for Bug 2704 – revised diff

[patch] revised diff

bz2704.diff (text/plain), 1.69 KB, created by Damien Miller on 2017-06-23 13:35:58 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Damien Miller

Created: 2017-06-23 13:35:58 AEST

Size: 1.69 KB

patch

obsolete

>diff --git a/packet.c b/packet.c
>index a3e2065..9b27b1f 100644
>--- a/packet.c
>+++ b/packet.c
>@@ -2202,9 +2202,7 @@ newkeys_to_blob(struct sshbuf *m, struct ssh *ssh, int mode)
> 		return r;
> 	if ((b = sshbuf_new()) == NULL)
> 		return SSH_ERR_ALLOC_FAIL;
>-	/* The cipher struct is constant and shared, you export pointer */
> 	if ((r = sshbuf_put_cstring(b, enc->name)) != 0 ||
>-	    (r = sshbuf_put(b, &enc->cipher, sizeof(enc->cipher))) != 0 ||
> 	    (r = sshbuf_put_u32(b, enc->enabled)) != 0 ||
> 	    (r = sshbuf_put_u32(b, enc->block_size)) != 0 ||
> 	    (r = sshbuf_put_string(b, enc->key, enc->key_len)) != 0 ||
>@@ -2278,12 +2276,15 @@ newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
> 	comp = &newkey->comp;
> 
> 	if ((r = sshbuf_get_cstring(b, &enc->name, NULL)) != 0 ||
>-	    (r = sshbuf_get(b, &enc->cipher, sizeof(enc->cipher))) != 0 ||
> 	    (r = sshbuf_get_u32(b, (u_int *)&enc->enabled)) != 0 ||
> 	    (r = sshbuf_get_u32(b, &enc->block_size)) != 0 ||
> 	    (r = sshbuf_get_string(b, &enc->key, &keylen)) != 0 ||
> 	    (r = sshbuf_get_string(b, &enc->iv, &ivlen)) != 0)
> 		goto out;
>+	if ((enc->cipher = cipher_by_name(enc->name)) == NULL) {
>+		r = SSH_ERR_INVALID_FORMAT;
>+		goto out;
>+	}
> 	if (cipher_authlen(enc->cipher) == 0) {
> 		if ((r = sshbuf_get_cstring(b, &mac->name, NULL)) != 0)
> 			goto out;
>@@ -2301,11 +2302,6 @@ newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
> 	if ((r = sshbuf_get_u32(b, &comp->type)) != 0 ||
> 	    (r = sshbuf_get_cstring(b, &comp->name, NULL)) != 0)
> 		goto out;
>-	if (enc->name == NULL ||
>-	    cipher_by_name(enc->name) != enc->cipher) {
>-		r = SSH_ERR_INVALID_FORMAT;
>-		goto out;
>-	}
> 	if (sshbuf_len(b) != 0) {
> 		r = SSH_ERR_INVALID_FORMAT;
> 		goto out;

Flags:

dtucker: ok+

Actions: View | Diff

Attachments on bug 2704: 2972 | 2997