Roll back previous KEX changes as they aren't safe until

compat_pkalg_proposal and friends always allocate their returned
strings.  Reported by Qualys.

diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c
index 2cd3ef0..cd0a4e8 100644 (file)
--- a/usr.bin/ssh/sshconnect2.c
+++ b/usr.bin/ssh/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.357 2022/06/24 04:37:00 dtucker Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.358 2022/06/24 10:45:06 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -109,7 +109,6 @@ first_alg(const char *algs)
        return ret;
 }
 
-/* Returns an allocated string that the caller must free. */
 static char *
 order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
     const struct ssh_conn_info *cinfo)
@@ -213,7 +212,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
     const struct ssh_conn_info *cinfo)
 {
        char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
-       char *s, *all_key, *hostkeyalgs = NULL;
+       char *s, *all_key;
        int r, use_known_hosts_order = 0;
 
        xxx_host = host;
@@ -251,10 +250,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
            myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
        if (use_known_hosts_order) {
                /* Query known_hosts and prefer algorithms that appear there */
-               hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
                myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
-                   compat_pkalg_proposal(ssh, hostkeyalgs);
-               free(hostkeyalgs);
+                   compat_pkalg_proposal(ssh,
+                   order_hostkeyalgs(host, hostaddr, port, cinfo));
        } else {
                /* Use specified HostkeyAlgorithms exactly */
                myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =

diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c
index f91e04a..16a5e4f 100644 (file)
--- a/usr.bin/ssh/sshd.c
+++ b/usr.bin/ssh/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.587 2022/06/24 04:37:00 dtucker Exp $ */
+/* $OpenBSD: sshd.c,v 1.588 2022/06/24 10:45:06 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -560,7 +560,6 @@ append_hostkey_type(struct sshbuf *b, const char *s)
                fatal_fr(r, "sshbuf_putf");
 }
 
-/* Returns an allocated string that the caller must free. */
 static char *
 list_hostkey_types(void)
 {
@@ -2195,7 +2194,6 @@ static void
 do_ssh2_kex(struct ssh *ssh)
 {
        char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
-       char *hostkey_types = NULL;
        struct kex *kex;
        int r;
 
@@ -2217,10 +2215,8 @@ do_ssh2_kex(struct ssh *ssh)
                ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
                    options.rekey_interval);
 
-       hostkey_types = list_hostkey_types();
        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
-           ssh, hostkey_types);
-       free(hostkey_types);
+           ssh, list_hostkey_types());
 
        /* start key exchange */
        if ((r = kex_setup(ssh, myproposal)) != 0)