diff options
| author | Werner Koch <wk@gnupg.org> | 2011-07-22 09:29:40 +0200 |
|---|---|---|
| committer | Werner Koch <wk@gnupg.org> | 2011-07-22 09:29:40 +0200 |
| commit | 6f86ee812fa5b063f8feb79f9e3e59eaa59e0209 (patch) | |
| tree | b1fa252e0f83fc897595bc6148832cd5ee61d45b /agent | |
| parent | Try to get the only-valid-if-cert-valid cert from the dirmngr first. (diff) | |
| download | gnupg2-6f86ee812fa5b063f8feb79f9e3e59eaa59e0209.tar.xz gnupg2-6f86ee812fa5b063f8feb79f9e3e59eaa59e0209.zip | |
Fix crash while reading unsupported ssh keys.
This bug was found by n-roeser at gmx.net
(gnupg-devel@, msgid 4DFC7298.4040509@gmx.net).
Diffstat (limited to 'agent')
| -rw-r--r-- | agent/ChangeLog | 5 | ||||
| -rw-r--r-- | agent/command-ssh.c | 18 |
2 files changed, 11 insertions, 12 deletions
diff --git a/agent/ChangeLog b/agent/ChangeLog index 95609cb3d..e1becac51 100644 --- a/agent/ChangeLog +++ b/agent/ChangeLog @@ -1,3 +1,8 @@ +2011-07-22 Werner Koch <wk@g10code.com> + + * command-ssh.c (ssh_receive_key): Do not init comment to an empty + static string; in the error case it would be freed. + 2011-07-20 Werner Koch <wk@g10code.com> * command.c (do_one_keyinfo, cmd_keyinfo): Support option --ssh-fpr. diff --git a/agent/command-ssh.c b/agent/command-ssh.c index 3fef83ec3..ae193ec94 100644 --- a/agent/command-ssh.c +++ b/agent/command-ssh.c @@ -1409,18 +1409,13 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret, int read_comment, ssh_key_type_spec_t *key_spec) { gpg_error_t err; - char *key_type; - char *comment; - gcry_sexp_t key; + char *key_type = NULL; + char *comment = NULL; + gcry_sexp_t key = NULL; ssh_key_type_spec_t spec; - gcry_mpi_t *mpi_list; + gcry_mpi_t *mpi_list = NULL; const char *elems; - mpi_list = NULL; - key_type = NULL; - comment = ""; - key = NULL; - err = stream_read_cstring (stream, &key_type); if (err) goto out; @@ -1452,7 +1447,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret, goto out; } - err = sexp_key_construct (&key, spec, secret, mpi_list, comment); + err = sexp_key_construct (&key, spec, secret, mpi_list, comment? comment:""); if (err) goto out; @@ -1464,8 +1459,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret, mpint_list_free (mpi_list); xfree (key_type); - if (read_comment) - xfree (comment); + xfree (comment); return err; } |