From f69b371bcd476a084639cddfb5cddfd3765413bc Mon Sep 17 00:00:00 2001 From: Ben Harris Date: Sat, 10 Oct 2015 00:11:15 +0100 Subject: [PATCH] ecdsa_newkey: fix a crash where the second curve name is missing or corrupt. Bug found with the help of afl-fuzz. --- sshecc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sshecc.c b/sshecc.c index 5f170215..9f188df8 100644 --- a/sshecc.c +++ b/sshecc.c @@ -1770,6 +1770,7 @@ static void *ecdsa_newkey(const struct ssh_signkey *self, /* Curve name is duplicated for Weierstrass form */ if (curve->type == EC_WEIERSTRASS) { getstring(&data, &len, &p, &slen); + if (!p) return NULL; if (!match_ssh_id(slen, p, curve->name)) return NULL; } -- 2.45.2