From 99ce9cefbe532ae979744c6d956b49f4b02aff82 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 1 May 2020 04:23:11 +0000 Subject: upstream: avoid NULL dereference when attempting to convert invalid ssh.com private keys using "ssh-keygen -i"; spotted by Michael Forney OpenBSD-Commit-ID: 2e56e6d26973967d11d13f56ea67145f435bf298 --- ssh-keygen.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ssh-keygen.c b/ssh-keygen.c index d50ca5f2..d7974f3d 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.407 2020/04/20 04:43:57 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.408 2020/05/01 04:23:11 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -669,9 +669,10 @@ do_convert_from_ssh2(struct passwd *pw, struct sshkey **k, int *private) encoded[len-3] = '\0'; if ((r = sshbuf_b64tod(buf, encoded)) != 0) fatal("%s: base64 decoding failed: %s", __func__, ssh_err(r)); - if (*private) - *k = do_convert_private_ssh2(buf); - else if ((r = sshkey_fromb(buf, k)) != 0) + if (*private) { + if ((*k = do_convert_private_ssh2(buf)) == NULL) + fatal("%s: private key conversion failed", __func__); + } else if ((r = sshkey_fromb(buf, k)) != 0) fatal("decode blob failed: %s", ssh_err(r)); sshbuf_free(buf); fclose(fp); -- cgit v1.2.3