Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CID-1128381: Avoid use after free

This commit is contained in:
christos 2013-11-11 16:32:10 +00:00
parent b82822977b
commit 93118e3396
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
crypto/external/bsd/openssh/dist/key.c vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: key.c,v 1.13 2013/11/08 19:18:25 christos Exp $ */
/* $NetBSD: key.c,v 1.14 2013/11/11 16:32:10 christos Exp $ */
/* $OpenBSD: key.c,v 1.104 2013/05/19 02:42:42 djm Exp $ */
/*
* read_bignum():
@ -36,7 +36,7 @@
*/
#include "includes.h"
__RCSID("$NetBSD: key.c,v 1.13 2013/11/08 19:18:25 christos Exp $");
__RCSID("$NetBSD: key.c,v 1.14 2013/11/11 16:32:10 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
@ -1512,6 +1512,8 @@ to_blob(const Key *key, u_char **blobp, u_int *lenp, int force_plain)
Buffer b;
int len, type;
if (blobp)
*blobp = NULL;
if (key == NULL) {
error("key_to_blob: key == NULL");
return 0;

7
crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: ssh-pkcs11-helper.c,v 1.5 2013/11/08 19:18:25 christos Exp $ */
/* $NetBSD: ssh-pkcs11-helper.c,v 1.6 2013/11/11 16:32:10 christos Exp $ */
/* $OpenBSD: ssh-pkcs11-helper.c,v 1.6 2013/05/17 00:13:14 djm Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
@ -16,7 +16,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
__RCSID("$NetBSD: ssh-pkcs11-helper.c,v 1.5 2013/11/08 19:18:25 christos Exp $");
__RCSID("$NetBSD: ssh-pkcs11-helper.c,v 1.6 2013/11/11 16:32:10 christos Exp $");
#include <sys/queue.h>
#include <sys/types.h>
@ -124,7 +124,8 @@ process_add(void)
buffer_put_char(&msg, SSH2_AGENT_IDENTITIES_ANSWER);
buffer_put_int(&msg, nkeys);
for (i = 0; i < nkeys; i++) {
key_to_blob(keys[i], &blob, &blen);
if (key_to_blob(keys[i], &blob, &blen) == 0)
continue;
buffer_put_string(&msg, blob, blen);
buffer_put_cstring(&msg, name);
free(blob);