Add another missing bounds check in the SSH-1 private key loader.

[originally from svn r9904]

diff --git a/sshpubk.c b/sshpubk.c
index bd3c5e47c4cc66b5661844155e9e35acffa392ce..b860040dbfbe55f321978a8c2b0d8c6fdead895f 100644 (file)
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -74,7 +74,7 @@ static int loadrsakey_main(FILE * fp, struct RSAKey *key, int pub_only,
     /* Next, the comment field. */
     j = GET_32BIT(buf + i);
     i += 4;
-    if (len - i < j)
+    if (j < 0 || len - i < j)
        goto end;
     comment = snewn(j + 1, char);
     if (comment) {