From af1da2469967bdb6fcabd17750d1c5f88a3389d0 Mon Sep 17 00:00:00 2001
From: simon <simon@cda61777-01e9-0310-a592-d414129be87e>
Date: Mon, 8 Jul 2013 22:36:04 +0000
Subject: [PATCH] Add an assortment of extra safety checks.

git-svn-id: svn://svn.tartarus.org/sgt/putty@9896 cda61777-01e9-0310-a592-d414129be87e
---
 import.c | 2 +-
 sshdss.c | 4 +++-
 sshrsa.c | 2 ++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/import.c b/import.c
index bb863d77..ce957bc4 100644
--- a/import.c
+++ b/import.c
@@ -290,7 +290,7 @@ static int ssh2_read_mpint(void *data, int len, struct mpint_pos *ret)
     if (len < 4)
         goto error;
     bytes = GET_32BIT(d);
-    if (len < 4+bytes)
+    if (bytes < 0 || len-4 < bytes)
         goto error;
 
     ret->start = d + 4;
diff --git a/sshdss.c b/sshdss.c
index 6cf5830d..1f15cee9 100644
--- a/sshdss.c
+++ b/sshdss.c
@@ -43,6 +43,8 @@ static void getstring(char **data, int *datalen, char **p, int *length)
     if (*datalen < 4)
 	return;
     *length = GET_32BIT(*data);
+    if (*length < 0)
+        return;
     *datalen -= 4;
     *data += 4;
     if (*datalen < *length)
@@ -98,7 +100,7 @@ static void *dss_newkey(char *data, int len)
     }
 #endif
 
-    if (!p || memcmp(p, "ssh-dss", 7)) {
+    if (!p || slen != 7 || memcmp(p, "ssh-dss", 7)) {
 	sfree(dss);
 	return NULL;
     }
diff --git a/sshrsa.c b/sshrsa.c
index 77a6bb25..163a92b0 100644
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -526,6 +526,8 @@ static void getstring(char **data, int *datalen, char **p, int *length)
     if (*datalen < 4)
 	return;
     *length = GET_32BIT(*data);
+    if (*length < 0)
+        return;
     *datalen -= 4;
     *data += 4;
     if (*datalen < *length)
-- 
2.11.0