Fix externally added SSH1 keys in Pageant. I have no idea how this

code _ever_ worked before! But it's been like this for four months
and nobody has noticed, including me. That's quite spooky.

[originally from svn r1219]

diff --git a/pageant.c b/pageant.c
index 503cb8575b7d926fc7d009d29d91a810c49ae00d..e00186398750d9be56c8ca84e43f8d6a3e9c4997 100644 (file)
--- a/pageant.c
+++ b/pageant.c
@@ -650,16 +650,19 @@ static void answer_msg(void *msg)
        {
            struct RSAKey *key;
            char *comment;
+            int commentlen;
            key = smalloc(sizeof(struct RSAKey));
            memset(key, 0, sizeof(key));
            p += makekey(p, key, NULL, 1);
            p += makeprivate(p, key);
-           p += ssh1_read_bignum(p, key->iqmp);        /* p^-1 mod q */
-           p += ssh1_read_bignum(p, key->p);   /* p */
-           p += ssh1_read_bignum(p, key->q);   /* q */
-           comment = smalloc(GET_32BIT(p));
+           p += ssh1_read_bignum(p, &key->iqmp);       /* p^-1 mod q */
+           p += ssh1_read_bignum(p, &key->p);  /* p */
+           p += ssh1_read_bignum(p, &key->q);  /* q */
+            commentlen = GET_32BIT(p);
+           comment = smalloc(commentlen+1);
            if (comment) {
-               memcpy(comment, p + 4, GET_32BIT(p));
+               memcpy(comment, p + 4, commentlen);
+                comment[commentlen] = '\0';
                key->comment = comment;
            }
            PUT_32BIT(ret, 1);