tjh.dev
1commit 1b0d9bcc5f5cd78b0bb1357d6a11da5d616ad26f
2Author: Wout Mertens <Wout.Mertens@gmail.com>
3Date: Thu Jun 11 18:08:13 2020 +0200
4
5 fix segfault when using ECDSA keys.
6
7 Author: Marc Deslauriers <marc.deslauriers@canonical.com>
8 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1869512
9
10diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
11index 5b13b30..5bf29cc 100644
12--- a/ssh-ecdsa.c
13+++ b/ssh-ecdsa.c
14@@ -46,7 +46,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
15 u_int len, dlen;
16 Buffer b, bb;
17 #if OPENSSL_VERSION_NUMBER >= 0x10100005L
18- BIGNUM *r, *s;
19+ BIGNUM *r = NULL, *s = NULL;
20 #endif
21
22 if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
23@@ -137,20 +137,27 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
24
25 /* parse signature */
26 if ((sig = ECDSA_SIG_new()) == NULL)
27- pamsshagentauth_fatal("ssh_ecdsa_verify: DSA_SIG_new failed");
28+ pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_new failed");
29
30 pamsshagentauth_buffer_init(&b);
31 pamsshagentauth_buffer_append(&b, sigblob, len);
32 #if OPENSSL_VERSION_NUMBER < 0x10100005L
33 if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
34 (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
35+ pamsshagentauth_fatal("ssh_ecdsa_verify:"
36+ "pamsshagentauth_buffer_get_bignum2_ret failed");
37 #else
38- DSA_SIG_get0(sig, &r, &s);
39+ if ((r = BN_new()) == NULL)
40+ pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed");
41+ if ((s = BN_new()) == NULL)
42+ pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed");
43 if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) ||
44 (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1))
45-#endif
46 pamsshagentauth_fatal("ssh_ecdsa_verify:"
47 "pamsshagentauth_buffer_get_bignum2_ret failed");
48+ if (ECDSA_SIG_set0(sig, r, s) != 1)
49+ pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_set0 failed");
50+#endif
51
52 /* clean up */
53 memset(sigblob, 0, len);