breeze/openssh-portable
1
0
Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-01-12 00:04:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

upstream: avoid possible NULL deref if

Browse Source 
ssh_packet_check_rekey_blocklimit() called before the encrypted transport is
brought up.

OpenBSD-Commit-ID: fb998ccbe59865e33a8ab6a6577f254d39bdc72f
This commit is contained in:
djm@openbsd.org
2025-12-30 04:23:53 +00:00
committed by Damien Miller
parent b9c318777e
commit 5f2bc9cb86
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
packet.c
View File

@@ -1,4 +1,4 @@
/* $OpenBSD: packet.c,v 1.329 2025/12/30 00:35:37 djm Exp $ */
/* $OpenBSD: packet.c,v 1.330 2025/12/30 04:23:53 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1096,6 +1096,9 @@ ssh_packet_check_rekey_blocklimit(struct ssh *ssh, u_int packet_len, int hard)
state->p_read.packets > MAX_PACKETS)
return 1;
if (state->newkeys == NULL)
return 0;
/* Rekey after (cipher-specific) maximum blocks */
out_blocks = ROUNDUP(packet_len,
state->newkeys[MODE_OUT]->enc.block_size);