X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/blobdiff_plain/af1da2469967bdb6fcabd17750d1c5f88a3389d0..8d90b8b27bf086da6245030459ab3e5977313eb0:/sshdss.c

diff --git a/sshdss.c b/sshdss.c
index 1f15cee9..6487d75a 100644
--- a/sshdss.c
+++ b/sshdss.c
@@ -42,7 +42,7 @@ static void getstring(char **data, int *datalen, char **p, int *length)
     *p = NULL;
     if (*datalen < 4)
 	return;
-    *length = GET_32BIT(*data);
+    *length = toint(GET_32BIT(*data));
     if (*length < 0)
         return;
     *datalen -= 4;
@@ -72,6 +72,9 @@ static Bignum get160(char **data, int *datalen)
 {
     Bignum b;
 
+    if (*datalen < 20)
+        return NULL;
+
     b = bignum_from_bytes((unsigned char *)*data, 20);
     *data += 20;
     *datalen -= 20;
@@ -289,6 +292,8 @@ static int dss_verifysig(void *key, char *sig, int siglen,
 
     freebn(w);
     freebn(sha);
+    freebn(u1);
+    freebn(u2);
     freebn(gu1p);
     freebn(yu2p);
     freebn(gu1yu2p);
@@ -404,6 +409,7 @@ static void *dss_createkey(unsigned char *pub_blob, int pub_len,
     ytest = modpow(dss->g, dss->x, dss->p);
     if (0 != bignum_cmp(ytest, dss->y)) {
 	dss_freekey(dss);
+        freebn(ytest);
 	return NULL;
     }
     freebn(ytest);
@@ -427,11 +433,11 @@ static void *dss_openssh_createkey(unsigned char **blob, int *len)
     dss->x = getmp(b, len);
 
     if (!dss->p || !dss->q || !dss->g || !dss->y || !dss->x) {
-	sfree(dss->p);
-	sfree(dss->q);
-	sfree(dss->g);
-	sfree(dss->y);
-	sfree(dss->x);
+	freebn(dss->p);
+	freebn(dss->q);
+	freebn(dss->g);
+	freebn(dss->y);
+	freebn(dss->x);
 	sfree(dss);
 	return NULL;
     }