lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-14 04:18:54 +03:00
Code Activity

server: Fix segfault in dh_handshake_server()

Browse Source 
Thanks to Felix Jones

Fixes T91

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Andreas Schneider
2018-05-07 20:09:56 +02:00
parent 72f6b34dbc
commit 362b20a0bc
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/server.c
View File

@@ -293,6 +293,7 @@ static int dh_handshake_server(ssh_session session) {
ssh_key privkey; ssh_key privkey;
ssh_string sig_blob; ssh_string sig_blob;
ssh_string f; ssh_string f;
ssh_string pubkey_blob = NULL;
int rc; int rc;
if (ssh_dh_generate_y(session) < 0) { if (ssh_dh_generate_y(session) < 0) {
@@ -334,14 +335,23 @@ static int dh_handshake_server(ssh_session session) {
return -1; return -1;
} }
rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob);
if (rc != SSH_OK) {
ssh_set_error_oom(session);
ssh_string_free(f);
ssh_string_free(sig_blob);
return -1;
}
rc = ssh_buffer_pack(session->out_buffer, rc = ssh_buffer_pack(session->out_buffer,
"bSSS", "bSSS",
SSH2_MSG_KEXDH_REPLY, SSH2_MSG_KEXDH_REPLY,
session->next_crypto->server_pubkey, pubkey_blob,
f, f,
sig_blob); sig_blob);
ssh_string_free(f); ssh_string_free(f);
ssh_string_free(sig_blob); ssh_string_free(sig_blob);
ssh_string_free(pubkey_blob);
if(rc != SSH_OK){ if(rc != SSH_OK){
ssh_set_error_oom(session); ssh_set_error_oom(session);
ssh_buffer_reinit(session->out_buffer); ssh_buffer_reinit(session->out_buffer);