===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/authfile.c,v
retrieving revision 1.55
retrieving revision 1.55.2.2
diff -u -r1.55 -r1.55.2.2
--- src/usr.bin/ssh/authfile.c	2003/09/18 07:56:05	1.55
+++ src/usr.bin/ssh/authfile.c	2005/03/10 17:15:04	1.55.2.2
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.55 2003/09/18 07:56:05 markus Exp $");
+RCSID("$OpenBSD: authfile.c,v 1.55.2.2 2005/03/10 17:15:04 brad Exp $");
 
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -51,6 +51,7 @@
 #include "log.h"
 #include "authfile.h"
 #include "rsa.h"
+#include "misc.h"
 
 /* Version identification string for SSH v1 identity files. */
 static const char authfile_id_string[] =
@@ -72,7 +73,7 @@
 	int fd, i, cipher_num;
 	CipherContext ciphercontext;
 	Cipher *cipher;
-	u_int32_t rand;
+	u_int32_t rnd;
 
 	/*
 	 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
@@ -87,9 +88,9 @@
 	buffer_init(&buffer);
 
 	/* Put checkbytes for checking passphrase validity. */
-	rand = arc4random();
-	buf[0] = rand & 0xff;
-	buf[1] = (rand >> 8) & 0xff;
+	rnd = arc4random();
+	buf[0] = rnd & 0xff;
+	buf[1] = (rnd >> 8) & 0xff;
 	buf[2] = buf[0];
 	buf[3] = buf[1];
 	buffer_append(&buffer, buf, 4);
@@ -236,14 +237,18 @@
 	struct stat st;
 	char *cp;
 	int i;
-	off_t len;
+	size_t len;
 
 	if (fstat(fd, &st) < 0) {
 		error("fstat for key file %.200s failed: %.100s",
 		    filename, strerror(errno));
 		return NULL;
 	}
-	len = st.st_size;
+	if (st.st_size > 1*1024*1024) {
+		error("key file %.200s too large", filename);
+		return NULL;
+	}
+	len = (size_t)st.st_size;		/* truncated */
 
 	buffer_init(&buffer);
 	cp = buffer_append_space(&buffer, len);
@@ -318,7 +323,7 @@
     char **commentp)
 {
 	int i, check1, check2, cipher_type;
-	off_t len;
+	size_t len;
 	Buffer buffer, decrypted;
 	u_char *cp;
 	CipherContext ciphercontext;
@@ -332,7 +337,12 @@
 		close(fd);
 		return NULL;
 	}
-	len = st.st_size;
+	if (st.st_size > 1*1024*1024) {
+		error("key file %.200s too large", filename);
+		close(fd);
+		return (NULL);
+	}
+	len = (size_t)st.st_size;		/* truncated */
 
 	buffer_init(&buffer);
 	cp = buffer_append_space(&buffer, len);
@@ -589,13 +599,14 @@
 key_try_load_public(Key *k, const char *filename, char **commentp)
 {
 	FILE *f;
-	char line[4096];
+	char line[SSH_MAX_PUBKEY_BYTES];
 	char *cp;
+	u_long linenum = 0;
 
 	f = fopen(filename, "r");
 	if (f != NULL) {
-		while (fgets(line, sizeof(line), f)) {
-			line[sizeof(line)-1] = '\0';
+		while (read_keyfile_line(f, filename, line, sizeof(line),
+			    &linenum) != -1) {
 			cp = line;
 			switch (*cp) {
 			case '#':