]> asedeno.scripts.mit.edu Git - PuTTY.git/commit
Fix potential segfaults in reading OpenSSH's ASN.1 key format.
authorSimon Tatham <anakin@pobox.com>
Thu, 25 Feb 2016 20:26:33 +0000 (20:26 +0000)
committerSimon Tatham <anakin@pobox.com>
Mon, 29 Feb 2016 19:59:32 +0000 (19:59 +0000)
commitf0222e74645297e410f90815c16474918d6ca41b
tree2af6845f2f98f2a776c07864d7acd99fe2cd76a6
parentcac650b8a56a362b5fc8f6309ad83734bf6a71e5
Fix potential segfaults in reading OpenSSH's ASN.1 key format.

The length coming back from ber_read_id_len might have overflowed, so
treat it as potentially negative. Also, while I'm here, accumulate it
inside ber_read_id_len as an unsigned, so as to avoid undefined
behaviour on integer overflow, and toint() it before return.

Thanks to Hanno Böck for spotting this, with the aid of AFL.

(cherry picked from commit 5b7833cd474a24ec098654dcba8cb9509f3bf2c1)

Conflicts:
import.c

(cherry-picker's note: resolving the conflict involved removing an
entire section of the original commit which fixed ECDSA code not
present on this branch)
import.c