security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-11-10 21:38:50 +01:00
Code Activity

Fix crash while reading unsupported ssh keys.

Browse Source 
This bug was found by n-roeser at gmx.net
(gnupg-devel@, msgid 4DFC7298.4040509@gmx.net).
This commit is contained in:
Werner Koch 2011-07-22 09:29:40 +02:00
parent 2d0ca28a22
commit 6f86ee812f
2 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
agent/ChangeLog
View File

@ -1,3 +1,8 @@
2011-07-22 Werner Koch <wk@g10code.com>
* command-ssh.c (ssh_receive_key): Do not init comment to an empty
static string; in the error case it would be freed.
2011-07-20 Werner Koch <wk@g10code.com> 2011-07-20 Werner Koch <wk@g10code.com>
* command.c (do_one_keyinfo, cmd_keyinfo): Support option --ssh-fpr. * command.c (do_one_keyinfo, cmd_keyinfo): Support option --ssh-fpr.

18
agent/command-ssh.c
View File

@ -1409,18 +1409,13 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
int read_comment, ssh_key_type_spec_t *key_spec) int read_comment, ssh_key_type_spec_t *key_spec)
{ {
gpg_error_t err; gpg_error_t err;
char *key_type; char *key_type = NULL;
char *comment; char *comment = NULL;
gcry_sexp_t key; gcry_sexp_t key = NULL;
ssh_key_type_spec_t spec; ssh_key_type_spec_t spec;
gcry_mpi_t *mpi_list; gcry_mpi_t *mpi_list = NULL;
const char *elems; const char *elems;
mpi_list = NULL;
key_type = NULL;
comment = "";
key = NULL;
err = stream_read_cstring (stream, &key_type); err = stream_read_cstring (stream, &key_type);
if (err) if (err)
goto out; goto out;
@ -1452,7 +1447,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
goto out; goto out;
} }
err = sexp_key_construct (&key, spec, secret, mpi_list, comment); err = sexp_key_construct (&key, spec, secret, mpi_list, comment? comment:"");
if (err) if (err)
goto out; goto out;
@ -1464,8 +1459,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
mpint_list_free (mpi_list); mpint_list_free (mpi_list);
xfree (key_type); xfree (key_type);
if (read_comment) xfree (comment);
xfree (comment);
return err; return err;
} }