diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-02-07 03:27:54 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-02-07 14:31:02 +1100 |
| commit | fd68dc27864b099b552a6d9d507ca4b83afd6a76 (patch) | |
| tree | 802ef9ef60fab818d4c6701f962e5c608224f760 | |
| parent | 96bd895a0a0b3a36f81c14db8c91513578fc5563 (diff) | |
upstream: fix two PIN entry bugs on FIDO keygen: 1) it would allow more
than the intended number of prompts (3) and 2) it would SEGV too many
incorrect PINs were entered; based on patch by Gabriel Kihlman
OpenBSD-Commit-ID: 9c0011f28ba8bd8adf2014424b64960333da1718
| -rw-r--r-- | ssh-keygen.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/ssh-keygen.c b/ssh-keygen.c index a6ba6cc7..0d6ed1ff 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.397 2020/02/06 22:30:54 naddy Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.398 2020/02/07 03:27:54 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -3588,7 +3588,7 @@ main(int argc, char **argv) passphrase = NULL; if ((attest = sshbuf_new()) == NULL) fatal("sshbuf_new failed"); - for (i = 0 ; i < 3; i++) { + for (i = 0 ; ; i++) { fflush(stdout); r = sshsk_enroll(type, sk_provider, sk_device, sk_application == NULL ? "ssh:" : sk_application, @@ -3598,15 +3598,21 @@ main(int argc, char **argv) break; if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) fatal("Key enrollment failed: %s", ssh_err(r)); - if (passphrase != NULL) + else if (i > 0) + error("PIN incorrect"); + if (passphrase != NULL) { freezero(passphrase, strlen(passphrase)); + passphrase = NULL; + } + if (i >= 3) + fatal("Too many incorrect PINs"); passphrase = read_passphrase("Enter PIN for " "authenticator: ", RP_ALLOW_STDIN); } - if (passphrase != NULL) + if (passphrase != NULL) { freezero(passphrase, strlen(passphrase)); - if (i > 3) - fatal("Too many incorrect PINs"); + passphrase = NULL; + } break; default: if ((r = sshkey_generate(type, bits, &private)) != 0) |