=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-keygen.c,v retrieving revision 1.467 retrieving revision 1.470 diff -u -r1.467 -r1.470 --- src/usr.bin/ssh/ssh-keygen.c 2023/04/12 08:53:54 1.467 +++ src/usr.bin/ssh/ssh-keygen.c 2023/07/17 04:01:10 1.470 @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.467 2023/04/12 08:53:54 jsg Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.470 2023/07/17 04:01:10 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -976,6 +976,7 @@ * accept a public key prefixed with a hostname or options. * Try a bare key first, otherwise skip the leading stuff. */ + comment = NULL; if ((public = try_read_key(&cp)) == NULL) { i = strtol(cp, &ep, 10); if (i == 0 || ep == NULL || @@ -2199,7 +2200,7 @@ if ((r = sshbuf_load_file(path, &krlbuf)) != 0) fatal_r(r, "Unable to load KRL %s", path); /* XXX check sigs */ - if ((r = ssh_krl_from_blob(krlbuf, krlp, NULL, 0)) != 0 || + if ((r = ssh_krl_from_blob(krlbuf, krlp)) != 0 || *krlp == NULL) fatal_r(r, "Invalid KRL file %s", path); sshbuf_free(krlbuf); @@ -2222,7 +2223,8 @@ * OpenSSH base64 hashes omit trailing '=' * characters; put them back for decode. */ - tlen = strlen(cp); + if ((tlen = strlen(cp)) >= SIZE_MAX - 5) + fatal_f("hash too long: %zu bytes", tlen); tmp = xmalloc(tlen + 4 + 1); strlcpy(tmp, cp, tlen + 1); while ((tlen % 4) != 0) { @@ -2264,6 +2266,10 @@ if (!quiet) printf("Revoking from %s\n", path); while (getline(&line, &linesize, krl_spec) != -1) { + if (linesize >= INT_MAX) { + fatal_f("%s contains unparsable line, len=%zu", + path, linesize); + } lnum++; was_explicit_key = was_sha1 = was_sha256 = was_hash = 0; cp = line + strspn(line, " \t"); @@ -2437,7 +2443,7 @@ if ((kbuf = sshbuf_new()) == NULL) fatal("sshbuf_new failed"); - if (ssh_krl_to_blob(krl, kbuf, NULL, 0) != 0) + if (ssh_krl_to_blob(krl, kbuf) != 0) fatal("Couldn't generate KRL"); if ((r = sshbuf_write_file(identity_file, kbuf)) != 0) fatal("write %s: %s", identity_file, strerror(errno));