X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/86dc445a1405f2075cf891dfbb67ac5acb289ee9..f4275b53be3317ee7391a48a4ac1d1681b3017bc:/ssh.c

diff --git a/ssh.c b/ssh.c
index f5a36adf..e0556a62 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1267,7 +1267,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
      * _Completely_ silly lengths should be stomped on before they
      * do us any more damage.
      */
-    if (st->len < 0 || st->pad < 0 || st->len + st->pad < 0) {
+    if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
+	st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
 	bombout(("Incoming packet was garbled on decryption"));
 	ssh_free_packet(st->pktin);
 	crStop(NULL);
@@ -1652,8 +1653,6 @@ static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
     unsigned char *p;
     int i, n = (bignum_bitcount(b) + 7) / 8;
     p = snewn(n + 1, unsigned char);
-    if (!p)
-	fatalbox("out of memory");
     p[0] = 0;
     for (i = 1; i <= n; i++)
 	p[i] = bignum_byte(b, n - i);
@@ -2246,10 +2245,12 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 
     if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
 	(ssh->cfg.sshbug_rekey2 == AUTO &&
-	 (wc_match("OpenSSH_2.[0-4]*", imp) ||
+	 (wc_match("DigiSSH_2.0", imp) ||
+	  wc_match("OpenSSH_2.[0-4]*", imp) ||
 	  wc_match("OpenSSH_2.5.[0-3]*", imp) ||
 	  wc_match("Sun_SSH_1.0", imp) ||
-	  wc_match("Sun_SSH_1.0.1", imp)))) {
+	  wc_match("Sun_SSH_1.0.1", imp) ||
+	  wc_match("WeOnlyDo-1.2.6", imp)))) {
 	/*
 	 * These versions have the SSH-2 rekey bug.
 	 */
@@ -2295,23 +2296,20 @@ static int do_ssh_init(Ssh ssh, unsigned char c)
 
     crBegin(ssh->do_ssh_init_crstate);
 
-    /* Search for the string "SSH-" in the input. */
-    s->i = 0;
-    while (1) {
-	static const int transS[] = { 1, 2, 2, 1 };
-	static const int transH[] = { 0, 0, 3, 0 };
-	static const int transminus[] = { 0, 0, 0, -1 };
-	if (c == 'S')
-	    s->i = transS[s->i];
-	else if (c == 'H')
-	    s->i = transH[s->i];
-	else if (c == '-')
-	    s->i = transminus[s->i];
-	else
-	    s->i = 0;
-	if (s->i < 0)
-	    break;
-	crReturn(1);		       /* get another character */
+    /* Search for a line beginning with the string "SSH-" in the input. */
+    for (;;) {
+	if (c != 'S') goto no;
+	crReturn(1);
+	if (c != 'S') goto no;
+	crReturn(1);
+	if (c != 'H') goto no;
+	crReturn(1);
+	if (c != '-') goto no;
+	break;
+      no:
+	while (c != '\012')
+	    crReturn(1);
+	crReturn(1);
     }
 
     s->vstrsize = 16;
@@ -2657,8 +2655,6 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
     const char *err;
 
     ssh->savedhost = snewn(1 + strlen(host), char);
-    if (!ssh->savedhost)
-	fatalbox("Out of memory");
     strcpy(ssh->savedhost, host);
 
     if (port < 0)
@@ -3011,8 +3007,6 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
     s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
 
     s->rsabuf = snewn(s->len, unsigned char);
-    if (!s->rsabuf)
-	fatalbox("Out of memory");
 
     /*
      * Verify the host key.
@@ -3024,8 +3018,6 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	int len = rsastr_len(&hostkey);
 	char fingerprint[100];
 	char *keystr = snewn(len, char);
-	if (!keystr)
-	    fatalbox("Out of memory");
 	rsastr_fmt(keystr, &hostkey);
 	rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
 
@@ -5731,7 +5723,7 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
      * it would only confuse the layer above.
      */
     if (s->activated_authconn) {
-	crReturn(1);
+	crReturn(0);
     }
     s->activated_authconn = TRUE;
 
@@ -6357,7 +6349,7 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
 	    }
 	}
     } else if (typelen == 22 &&
-	       !memcmp(type, "auth-agent@openssh.com", 3)) {
+	       !memcmp(type, "auth-agent@openssh.com", 22)) {
 	if (!ssh->agentfwd_enabled)
 	    error = "Agent forwarding is not enabled";
 	else {