diff options
author | dtucker@openbsd.org <dtucker@openbsd.org> | 2016-06-01 04:19:49 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2016-06-08 11:39:31 +1000 |
commit | 6b87311d3acdc460f926b2c40f4c4f3fd345f368 (patch) | |
tree | d5eddb0502025f9bcfb48587509db964d49ab1b2 /kexgexs.c | |
parent | 564cd2a8926ccb1dca43a535073540935b5e0373 (diff) |
upstream commit
Check min and max sizes sent by the client against what
we support before passing them to the monitor. ok djm@
Upstream-ID: 750627e8117084215412bff00a25b1586ab17ece
Diffstat (limited to 'kexgexs.c')
-rw-r--r-- | kexgexs.c | 18 |
1 files changed, 9 insertions, 9 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: kexgexs.c,v 1.27 2016/05/31 23:46:14 dtucker Exp $ */ +/* $OpenBSD: kexgexs.c,v 1.28 2016/06/01 04:19:49 dtucker Exp $ */ /* * Copyright (c) 2000 Niels Provos. All rights reserved. * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -83,21 +83,21 @@ input_kex_dh_gex_request(int type, u_int32_t seq, void *ctxt) kex->nbits = nbits; kex->min = min; kex->max = max; - min = MAX(DH_GRP_MIN, min); - max = MIN(DH_GRP_MAX, max); - nbits = MAX(DH_GRP_MIN, nbits); - nbits = MIN(DH_GRP_MAX, nbits); - if (kex->max < kex->min || kex->nbits < kex->min || - kex->max < kex->nbits || kex->max < DH_GRP_MIN) { + kex->max < kex->nbits || kex->max < DH_GRP_MIN || + kex->min > DH_GRP_MAX) { r = SSH_ERR_DH_GEX_OUT_OF_RANGE; goto out; } + kex->min = MAX(DH_GRP_MIN, kex->min); + kex->max = MIN(DH_GRP_MAX, kex->max); + kex->nbits = MAX(DH_GRP_MIN, kex->nbits); + kex->nbits = MIN(DH_GRP_MAX, kex->nbits); /* Contact privileged parent */ - kex->dh = PRIVSEP(choose_dh(min, nbits, max)); + kex->dh = PRIVSEP(choose_dh(kex->min, kex->nbits, kex->max)); if (kex->dh == NULL) { - sshpkt_disconnect(ssh, "no matching DH grp found"); + sshpkt_disconnect(ssh, "no matching DH group found"); r = SSH_ERR_ALLOC_FAIL; goto out; } |