ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-02-14 16:35:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

avoid leak of pubkey_options

Browse Source
This commit is contained in:
Matt Johnston 2018-03-06 22:18:20 +08:00
parent 4fd3160179
commit e9edbe8bb2
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fuzzer-pubkey.c
View File

@ -30,10 +30,16 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (have_algo(algoname, algolen, sshhostkey) == DROPBEAR_FAILURE) { if (have_algo(algoname, algolen, sshhostkey) == DROPBEAR_FAILURE) {
dropbear_exit("fuzzer imagined a bogus algorithm"); dropbear_exit("fuzzer imagined a bogus algorithm");
} }
fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys",
int ret = fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys",
algoname, algolen, algoname, algolen,
keyblob->data, keyblob->len); keyblob->data, keyblob->len);
if (ret == DROPBEAR_SUCCESS) {
/* fuzz_checkpubkey_line() should have cleaned up for failure */
svr_pubkey_options_cleanup();
}
buf_free(line); buf_free(line);
buf_free(keyblob); buf_free(keyblob);
m_free(algoname); m_free(algoname);

4
svr-authpubkey.c
View File

@ -167,6 +167,10 @@ out:
sign_key_free(key); sign_key_free(key);
key = NULL; key = NULL;
} }
/* Retain pubkey options only if auth succeeded */
if (!ses.authstate.authdone) {
svr_pubkey_options_cleanup();
}
TRACE(("leave pubkeyauth")) TRACE(("leave pubkeyauth"))
} }

1
svr-authpubkeyoptions.c
View File

@ -113,7 +113,6 @@ void svr_pubkey_options_cleanup() {
m_free(ses.authstate.pubkey_options->forced_command); m_free(ses.authstate.pubkey_options->forced_command);
} }
m_free(ses.authstate.pubkey_options); m_free(ses.authstate.pubkey_options);
ses.authstate.pubkey_options = NULL;
} }
} }