shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-04 12:20:42 +09:00
Code Issues Packages Projects Releases Wiki Activity

kex: Use a len variable for length checks in ssh_packet_kexinit()

Browse Source 
Fixes T188

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit be34ff967f)
This commit is contained in:
Andreas Schneider
2019-10-31 13:58:35 +01:00
parent dfd73d7cb2
commit 675d85e538
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/kex.c
View File

@@ -334,6 +334,7 @@ SSH_PACKET_CALLBACK(ssh_packet_kexinit)
char *strings[SSH_KEX_METHODS] = {0};
char *rsa_sig_ext = NULL;
int rc = SSH_ERROR;
size_t len;
uint8_t first_kex_packet_follows = 0;
uint32_t kexinit_reserved = 0;
@@ -349,26 +350,26 @@ SSH_PACKET_CALLBACK(ssh_packet_kexinit)
}
if (server_kex) {
rc = ssh_buffer_get_data(packet,session->next_crypto->client_kex.cookie, 16);
if (rc != 16) {
len = ssh_buffer_get_data(packet,session->next_crypto->client_kex.cookie, 16);
if (len != 16) {
ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: no cookie in packet");
goto error;
}
rc = ssh_hashbufin_add_cookie(session, session->next_crypto->client_kex.cookie);
if (rc < 0) {
len = ssh_hashbufin_add_cookie(session, session->next_crypto->client_kex.cookie);
if (len < 0) {
ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: adding cookie failed");
goto error;
}
} else {
rc = ssh_buffer_get_data(packet,session->next_crypto->server_kex.cookie, 16);
if (rc != 16) {
len = ssh_buffer_get_data(packet,session->next_crypto->server_kex.cookie, 16);
if (len != 16) {
ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: no cookie in packet");
goto error;
}
rc = ssh_hashbufin_add_cookie(session, session->next_crypto->server_kex.cookie);
if (rc < 0) {
len = ssh_hashbufin_add_cookie(session, session->next_crypto->server_kex.cookie);
if (len < 0) {
ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: adding cookie failed");
goto error;
}