lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-20 02:42:09 +03:00
Code Activity

kex.c: use string_buf in ecdh_sha2_nistp (#551)

Browse Source 
* kex.c: use string_buf in ecdh_sha2_nistp

file: kex.c

notes:
use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
This commit is contained in:
Will Cosgrove
2021-01-30 19:32:14 -08:00
committed by GitHub
parent 1f76151c92
commit c69f1f27dc
1 changed files with 23 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
src/kex.c
View File

@@ -1752,26 +1752,24 @@ static int ecdh_sha2_nistp(LIBSSH2_SESSION *session, libssh2_curve_type type,
/* parse INIT reply data */
/* host key K_S */
unsigned char *s = data + 1; /* Advance past packet type */
unsigned char *server_public_key;
size_t server_public_key_len;
size_t host_sig_len;
struct string_buf buf;
session->server_hostkey_len =
_libssh2_ntohu32((const unsigned char *)s);
s += 4;
buf.data = data;
buf.len = data_len;
buf.dataptr = buf.data;
buf.dataptr++; /* Advance past packet type */
session->server_hostkey = LIBSSH2_ALLOC(session,
session->server_hostkey_len);
if(!session->server_hostkey) {
ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,
"Unable to allocate memory for a copy "
"of the host key");
if(_libssh2_copy_string(session, &buf, &(session->server_hostkey),
&server_public_key_len)) {
ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,
"Unable to allocate memory for a copy "
"of the host key");
goto clean_exit;
}
memcpy(session->server_hostkey, s, session->server_hostkey_len);
s += session->server_hostkey_len;
session->server_hostkey_len = (uint32_t)server_public_key_len;
#if LIBSSH2_MD5
{
@@ -1870,19 +1868,20 @@ static int ecdh_sha2_nistp(LIBSSH2_SESSION *session, libssh2_curve_type type,
}
/* server public key Q_S */
server_public_key_len = _libssh2_ntohu32((const unsigned char *)s);
s += 4;
server_public_key = s;
s += server_public_key_len;
if(_libssh2_get_string(&buf, &server_public_key,
&server_public_key_len)) {
ret = _libssh2_error(session, LIBSSH2_ERROR_PROTO,
"Unexpected key length");
goto clean_exit;
}
/* server signature */
host_sig_len = _libssh2_ntohu32((const unsigned char *)s);
s += 4;
exchange_state->h_sig = s;
exchange_state->h_sig_len = host_sig_len;
s += host_sig_len;
if(_libssh2_get_string(&buf, &exchange_state->h_sig,
&(exchange_state->h_sig_len))) {
ret = _libssh2_error(session, LIBSSH2_ERROR_HOSTKEY_INIT,
"Unexpected ecdh server sig length");
goto clean_exit;
}
/* Compute the shared secret K */
rc = _libssh2_ecdh_gen_k(&exchange_state->k, private_key,