shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2025-8114: Fix NULL pointer dereference after allocation failure

Browse Source 
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Andreas Schneider
2025-08-06 15:17:59 +02:00
committed by Jakub Jelen
parent ffed80f8c0
commit 53ac23ded4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/kex.c
View File

@@ -1569,6 +1569,8 @@ int ssh_make_sessionid(ssh_session session)
ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf)); ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf));
#endif #endif
/* Set rc for the following switch statement in case we goto error. */
rc = SSH_ERROR;
switch (session->next_crypto->kex_type) { switch (session->next_crypto->kex_type) {
case SSH_KEX_DH_GROUP1_SHA1: case SSH_KEX_DH_GROUP1_SHA1:
case SSH_KEX_DH_GROUP14_SHA1: case SSH_KEX_DH_GROUP14_SHA1:
@@ -1629,6 +1631,7 @@ int ssh_make_sessionid(ssh_session session)
session->next_crypto->secret_hash); session->next_crypto->secret_hash);
break; break;
} }
/* During the first kex, secret hash and session ID are equal. However, after /* During the first kex, secret hash and session ID are equal. However, after
* a key re-exchange, a new secret hash is calculated. This hash will not replace * a key re-exchange, a new secret hash is calculated. This hash will not replace
* but complement existing session id. * but complement existing session id.
@@ -1637,6 +1640,7 @@ int ssh_make_sessionid(ssh_session session)
session->next_crypto->session_id = malloc(session->next_crypto->digest_len); session->next_crypto->session_id = malloc(session->next_crypto->digest_len);
if (session->next_crypto->session_id == NULL) { if (session->next_crypto->session_id == NULL) {
ssh_set_error_oom(session); ssh_set_error_oom(session);
rc = SSH_ERROR;
goto error; goto error;
} }
memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash, memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash,