Skip to content

Commit ac9b4aa

Browse files
committed
dropbearconvert: Avoid uninitialised read
An openssh format input file with a nul byte could cause an out of bounds stack read. dropbearconvert would exit with failure. Reported by Yiyi Wang, Tsinghua University
1 parent 16279e7 commit ac9b4aa

1 file changed

Lines changed: 4 additions & 6 deletions

File tree

src/keyimport.c

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -402,10 +402,8 @@ static struct openssh_key *load_openssh_key(const char *filename)
402402
errmsg = "Unable to open key file";
403403
goto error;
404404
}
405-
if (!fgets(buffer, sizeof(buffer), fp) ||
406-
0 != strncmp(buffer, "-----BEGIN ", 11) ||
407-
0 != strcmp(buffer+strlen(buffer)-17, "PRIVATE KEY-----\n")) {
408-
errmsg = "File does not begin with OpenSSH key header";
405+
if (!fgets(buffer, sizeof(buffer), fp)) {
406+
errmsg = "Short input";
409407
goto error;
410408
}
411409
if (!strcmp(buffer, "-----BEGIN RSA PRIVATE KEY-----\n"))
@@ -428,9 +426,9 @@ static struct openssh_key *load_openssh_key(const char *filename)
428426
errmsg = "Unexpected end of file";
429427
goto error;
430428
}
431-
if (0 == strncmp(buffer, "-----END ", 9) &&
432-
0 == strcmp(buffer+strlen(buffer)-17, "PRIVATE KEY-----\n"))
429+
if (0 == strncmp(buffer, "-----END ", 9)) {
433430
break; /* done */
431+
}
434432
if ((p = strchr(buffer, ':')) != NULL) {
435433
if (headers_done) {
436434
errmsg = "Header found in body of key data";

0 commit comments

Comments
 (0)