diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2015-11-08 21:59:11 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2015-11-09 14:25:37 +1100 |
| commit | 2fecfd486bdba9f51b3a789277bb0733ca36e1c0 (patch) | |
| tree | c05509284f0ad0fa8d3e0fe46175546c224c713f | |
| parent | 5e288923a303ca672b686908320bc5368ebec6e6 (diff) | |
upstream commit
fix OOB read in packet code caused by missing return
statement found by Ben Hawkes; ok markus@ deraadt@
Upstream-ID: a3e3a85434ebfa0690d4879091959591f30efc62
| -rw-r--r-- | packet.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.216 2015/10/21 11:33:03 gsoares Exp $ */ +/* $OpenBSD: packet.c,v 1.217 2015/11/08 21:59:11 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1581,6 +1581,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) logit("Bad packet length %u.", state->packlen); if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0) return r; + return SSH_ERR_CONN_CORRUPT; } sshbuf_reset(state->incoming_packet); } else if (state->packlen == 0) { |