- n += ssh1_read_bignum(blob + n, &ssh1key->exponent);
- n += ssh1_read_bignum(blob + n, &ssh1key->modulus);
+
+ l = ssh1_read_bignum(blob + n, bloblen - n,
+ &ssh1key->exponent);
+ if (l < 0) {
+ error = "SSH-1 public key blob was too short";
+ } else {
+ n += l;
+ l = ssh1_read_bignum(blob + n, bloblen - n,
+ &ssh1key->modulus);
+ if (l < 0) {
+ error = "SSH-1 public key blob was too short";
+ } else
+ n += l;
+ }