Florian Gaab reports that freeSSHd 1.0.7, which claims a "softwareversion"

[u/mdw/putty] / ssh.c

diff --git a/ssh.c b/ssh.c
index 66b316e..e0556a6 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -1267,7 +1267,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
      * _Completely_ silly lengths should be stomped on before they
      * do us any more damage.
      */
-    if (st->len < 0 || st->pad < 0 || st->len + st->pad < 0) {
+    if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
+       st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
        bombout(("Incoming packet was garbled on decryption"));
        ssh_free_packet(st->pktin);
        crStop(NULL);
@@ -2244,10 +2245,12 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 
     if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
        (ssh->cfg.sshbug_rekey2 == AUTO &&
-        (wc_match("OpenSSH_2.[0-4]*", imp) ||
+        (wc_match("DigiSSH_2.0", imp) ||
+         wc_match("OpenSSH_2.[0-4]*", imp) ||
          wc_match("OpenSSH_2.5.[0-3]*", imp) ||
          wc_match("Sun_SSH_1.0", imp) ||
-         wc_match("Sun_SSH_1.0.1", imp)))) {
+         wc_match("Sun_SSH_1.0.1", imp) ||
+         wc_match("WeOnlyDo-1.2.6", imp)))) {
        /*
         * These versions have the SSH-2 rekey bug.
         */
@@ -2293,23 +2296,20 @@ static int do_ssh_init(Ssh ssh, unsigned char c)
 
     crBegin(ssh->do_ssh_init_crstate);
 
-    /* Search for the string "SSH-" in the input. */
-    s->i = 0;
-    while (1) {
-       static const int transS[] = { 1, 2, 2, 1 };
-       static const int transH[] = { 0, 0, 3, 0 };
-       static const int transminus[] = { 0, 0, 0, -1 };
-       if (c == 'S')
-           s->i = transS[s->i];
-       else if (c == 'H')
-           s->i = transH[s->i];
-       else if (c == '-')
-           s->i = transminus[s->i];
-       else
-           s->i = 0;
-       if (s->i < 0)
-           break;
-       crReturn(1);                   /* get another character */
+    /* Search for a line beginning with the string "SSH-" in the input. */
+    for (;;) {
+       if (c != 'S') goto no;
+       crReturn(1);
+       if (c != 'S') goto no;
+       crReturn(1);
+       if (c != 'H') goto no;
+       crReturn(1);
+       if (c != '-') goto no;
+       break;
+      no:
+       while (c != '\012')
+           crReturn(1);
+       crReturn(1);
     }
 
     s->vstrsize = 16;
@@ -5723,7 +5723,7 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
      * it would only confuse the layer above.
      */
     if (s->activated_authconn) {
-       crReturn(1);
+       crReturn(0);
     }
     s->activated_authconn = TRUE;