~mdw
/
sgt
/
putty
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Add some missing null checks for inst->ldisc, which were causing
[sgt/putty]
/
ssh.c
diff --git
a/ssh.c
b/ssh.c
index
66c84d1
..
30ee4ba
100644
(file)
--- a/
ssh.c
+++ b/
ssh.c
@@
-525,7
+525,7
@@
static void ssh_channel_destroy(struct ssh_channel *c);
const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
const static struct ssh_mac *macs[] = {
const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
const static struct ssh_mac *macs[] = {
- &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
+ &ssh_hmac_sha
256, &ssh_hmac_sha
1, &ssh_hmac_sha1_96, &ssh_hmac_md5
};
const static struct ssh_mac *buggymacs[] = {
&ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
};
const static struct ssh_mac *buggymacs[] = {
&ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
@@
-3271,7
+3271,6
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
{
int i, j, ret;
unsigned char cookie[8], *ptr;
{
int i, j, ret;
unsigned char cookie[8], *ptr;
- struct RSAKey servkey, hostkey;
struct MD5Context md5c;
struct do_ssh1_login_state {
int crLine;
struct MD5Context md5c;
struct do_ssh1_login_state {
int crLine;
@@
-3299,6
+3298,7
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
int commentlen;
int dlgret;
Filename *keyfile;
int commentlen;
int dlgret;
Filename *keyfile;
+ struct RSAKey servkey, hostkey;
};
crState(do_ssh1_login_state);
};
crState(do_ssh1_login_state);
@@
-3321,8
+3321,8
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
}
memcpy(cookie, ptr, 8);
}
memcpy(cookie, ptr, 8);
- if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
- !ssh1_pkt_getrsakey(pktin, &
hostkey, &s->keystr2)) {
+ if (!ssh1_pkt_getrsakey(pktin, &s
->s
ervkey, &s->keystr1) ||
+ !ssh1_pkt_getrsakey(pktin, &
s->hostkey, &s->keystr2)) {
bombout(("Failed to read SSH-1 public keys from public key packet"));
crStop(0);
}
bombout(("Failed to read SSH-1 public keys from public key packet"));
crStop(0);
}
@@
-3334,9
+3334,9
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
char logmsg[80];
logevent("Host key fingerprint is:");
strcpy(logmsg, " ");
char logmsg[80];
logevent("Host key fingerprint is:");
strcpy(logmsg, " ");
- hostkey.comment = NULL;
+
s->
hostkey.comment = NULL;
rsa_fingerprint(logmsg + strlen(logmsg),
rsa_fingerprint(logmsg + strlen(logmsg),
- sizeof(logmsg) - strlen(logmsg), &hostkey);
+ sizeof(logmsg) - strlen(logmsg), &
s->
hostkey);
logevent(logmsg);
}
logevent(logmsg);
}
@@
-3351,8
+3351,8
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
MD5Init(&md5c);
ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
MD5Init(&md5c);
- MD5Update(&md5c, s->keystr2, hostkey.bytes);
- MD5Update(&md5c, s->keystr1, servkey.bytes);
+ MD5Update(&md5c, s->keystr2,
s->
hostkey.bytes);
+ MD5Update(&md5c, s->keystr1, s
->s
ervkey.bytes);
MD5Update(&md5c, cookie, 8);
MD5Final(s->session_id, &md5c);
MD5Update(&md5c, cookie, 8);
MD5Final(s->session_id, &md5c);
@@
-3362,13
+3362,14
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
/*
* Verify that the `bits' and `bytes' parameters match.
*/
/*
* Verify that the `bits' and `bytes' parameters match.
*/
- if (
hostkey.bits >
hostkey.bytes * 8 ||
- s
ervkey.bits >
servkey.bytes * 8) {
+ if (
s->hostkey.bits > s->
hostkey.bytes * 8 ||
+ s
->servkey.bits > s->
servkey.bytes * 8) {
bombout(("SSH-1 public keys were badly formatted"));
crStop(0);
}
bombout(("SSH-1 public keys were badly formatted"));
crStop(0);
}
- s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
+ s->len = (s->hostkey.bytes > s->servkey.bytes ?
+ s->hostkey.bytes : s->servkey.bytes);
s->rsabuf = snewn(s->len, unsigned char);
s->rsabuf = snewn(s->len, unsigned char);
@@
-3379,11
+3380,11
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
/*
* First format the key into a string.
*/
/*
* First format the key into a string.
*/
- int len = rsastr_len(&hostkey);
+ int len = rsastr_len(&
s->
hostkey);
char fingerprint[100];
char *keystr = snewn(len, char);
char fingerprint[100];
char *keystr = snewn(len, char);
- rsastr_fmt(keystr, &hostkey);
- rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
+ rsastr_fmt(keystr, &
s->
hostkey);
+ rsa_fingerprint(fingerprint, sizeof(fingerprint), &
s->
hostkey);
ssh_set_frozen(ssh, 1);
s->dlgret = verify_ssh_host_key(ssh->frontend,
ssh_set_frozen(ssh, 1);
s->dlgret = verify_ssh_host_key(ssh->frontend,
@@
-3417,14
+3418,14
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
s->rsabuf[i] ^= s->session_id[i];
}
s->rsabuf[i] ^= s->session_id[i];
}
- if (
hostkey.bytes >
servkey.bytes) {
- ret = rsaencrypt(s->rsabuf, 32, &servkey);
+ if (
s->hostkey.bytes > s->
servkey.bytes) {
+ ret = rsaencrypt(s->rsabuf, 32, &s
->s
ervkey);
if (ret)
if (ret)
- ret = rsaencrypt(s->rsabuf, s
ervkey.bytes, &
hostkey);
+ ret = rsaencrypt(s->rsabuf, s
->servkey.bytes, &s->
hostkey);
} else {
} else {
- ret = rsaencrypt(s->rsabuf, 32, &hostkey);
+ ret = rsaencrypt(s->rsabuf, 32, &
s->
hostkey);
if (ret)
if (ret)
- ret = rsaencrypt(s->rsabuf,
hostkey.bytes, &
servkey);
+ ret = rsaencrypt(s->rsabuf,
s->hostkey.bytes, &s->
servkey);
}
if (!ret) {
bombout(("SSH-1 public key encryptions failed due to bad formatting"));
}
if (!ret) {
bombout(("SSH-1 public key encryptions failed due to bad formatting"));
@@
-3527,21
+3528,21
@@
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
ssh->crcda_ctx = crcda_make_context();
logevent("Installing CRC compensation attack detector");
ssh->crcda_ctx = crcda_make_context();
logevent("Installing CRC compensation attack detector");
- if (servkey.modulus) {
- sfree(servkey.modulus);
- servkey.modulus = NULL;
+ if (s
->s
ervkey.modulus) {
+ sfree(s
->s
ervkey.modulus);
+ s
->s
ervkey.modulus = NULL;
}
}
- if (servkey.exponent) {
- sfree(servkey.exponent);
- servkey.exponent = NULL;
+ if (s
->s
ervkey.exponent) {
+ sfree(s
->s
ervkey.exponent);
+ s
->s
ervkey.exponent = NULL;
}
}
- if (hostkey.modulus) {
- sfree(hostkey.modulus);
- hostkey.modulus = NULL;
+ if (
s->
hostkey.modulus) {
+ sfree(
s->
hostkey.modulus);
+
s->
hostkey.modulus = NULL;
}
}
- if (hostkey.exponent) {
- sfree(hostkey.exponent);
- hostkey.exponent = NULL;
+ if (
s->
hostkey.exponent) {
+ sfree(
s->
hostkey.exponent);
+
s->
hostkey.exponent = NULL;
}
crWaitUntil(pktin);
}
crWaitUntil(pktin);
@@
-9685,7
+9686,7
@@
static void ssh_free(void *handle)
while (ssh->qhead) {
struct queued_handler *qh = ssh->qhead;
ssh->qhead = qh->next;
while (ssh->qhead) {
struct queued_handler *qh = ssh->qhead;
ssh->qhead = qh->next;
- sfree(
ssh->qhead
);
+ sfree(
qh
);
}
ssh->qhead = ssh->qtail = NULL;
}
ssh->qhead = ssh->qtail = NULL;