From 6cd7ecd829033adcb05d5d83db0e956615a384a9 Mon Sep 17 00:00:00 2001 From: dtucker Date: Fri, 24 Jun 2022 10:45:06 +0000 Subject: [PATCH] Roll back previous KEX changes as they aren't safe until compat_pkalg_proposal and friends always allocate their returned strings. Reported by Qualys. --- usr.bin/ssh/sshconnect2.c | 10 ++++------ usr.bin/ssh/sshd.c | 8 ++------ 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index 2cd3ef072be..cd0a4e8de5b 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.357 2022/06/24 04:37:00 dtucker Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.358 2022/06/24 10:45:06 dtucker Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -109,7 +109,6 @@ first_alg(const char *algs) return ret; } -/* Returns an allocated string that the caller must free. */ static char * order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, const struct ssh_conn_info *cinfo) @@ -213,7 +212,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, const struct ssh_conn_info *cinfo) { char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; - char *s, *all_key, *hostkeyalgs = NULL; + char *s, *all_key; int r, use_known_hosts_order = 0; xxx_host = host; @@ -251,10 +250,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; if (use_known_hosts_order) { /* Query known_hosts and prefer algorithms that appear there */ - hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = - compat_pkalg_proposal(ssh, hostkeyalgs); - free(hostkeyalgs); + compat_pkalg_proposal(ssh, + order_hostkeyalgs(host, hostaddr, port, cinfo)); } else { /* Use specified HostkeyAlgorithms exactly */ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c index f91e04a574e..16a5e4ff8c1 100644 --- a/usr.bin/ssh/sshd.c +++ b/usr.bin/ssh/sshd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd.c,v 1.587 2022/06/24 04:37:00 dtucker Exp $ */ +/* $OpenBSD: sshd.c,v 1.588 2022/06/24 10:45:06 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -560,7 +560,6 @@ append_hostkey_type(struct sshbuf *b, const char *s) fatal_fr(r, "sshbuf_putf"); } -/* Returns an allocated string that the caller must free. */ static char * list_hostkey_types(void) { @@ -2195,7 +2194,6 @@ static void do_ssh2_kex(struct ssh *ssh) { char *myproposal[PROPOSAL_MAX] = { KEX_SERVER }; - char *hostkey_types = NULL; struct kex *kex; int r; @@ -2217,10 +2215,8 @@ do_ssh2_kex(struct ssh *ssh) ssh_packet_set_rekey_limits(ssh, options.rekey_limit, options.rekey_interval); - hostkey_types = list_hostkey_types(); myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( - ssh, hostkey_types); - free(hostkey_types); + ssh, list_hostkey_types()); /* start key exchange */ if ((r = kex_setup(ssh, myproposal)) != 0) -- 2.20.1