===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-pkcs11.c,v
retrieving revision 1.29
retrieving revision 1.30
diff -u -r1.29 -r1.30
--- src/usr.bin/ssh/ssh-pkcs11.c	2019/01/20 23:00:12	1.29
+++ src/usr.bin/ssh/ssh-pkcs11.c	2019/01/20 23:01:59	1.30
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.29 2019/01/20 23:00:12 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.30 2019/01/20 23:01:59 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -569,6 +569,7 @@
 	CK_SESSION_HANDLE	 session;
 	CK_FUNCTION_LIST	*f = NULL;
 	CK_RV			 rv;
+	ASN1_OCTET_STRING	*octet = NULL;
 	EC_KEY			*ec = NULL;
 	EC_GROUP		*group = NULL;
 	struct sshkey		*key = NULL;
@@ -637,16 +638,17 @@
 		goto fail;
 	}
 
-	attrp = (const unsigned char *)key_attr[1].pValue;
-	if (o2i_ECPublicKey(&ec, &attrp, key_attr[1].ulValueLen) == NULL) {
-		/* try to skip DER header (octet string type and length byte) */
-		attrp = (const unsigned char *)key_attr[1].pValue + 2;
-		if (o2i_ECPublicKey(&ec, &attrp, key_attr[1].ulValueLen - 2)
-		    == NULL) {
-			ossl_error("o2i_ECPublicKey failed");
-			goto fail;
-		}
+	attrp = key_attr[1].pValue;
+	octet = d2i_ASN1_OCTET_STRING(NULL, &attrp, key_attr[1].ulValueLen);
+	if (octet == NULL) {
+		ossl_error("d2i_ASN1_OCTET_STRING failed");
+		goto fail;
 	}
+	attrp = octet->data;
+	if (o2i_ECPublicKey(&ec, &attrp, octet->length) == NULL) {
+		ossl_error("o2i_ECPublicKey failed");
+		goto fail;
+	}
 
 	nid = sshkey_ecdsa_key_to_nid(ec);
 	if (nid < 0) {
@@ -676,6 +678,8 @@
 		EC_KEY_free(ec);
 	if (group)
 		EC_GROUP_free(group);
+	if (octet)
+		ASN1_OCTET_STRING_free(octet);
 
 	return (key);
 }