pkgs/os-specific/linux/pam_ssh_agent_auth/edcsa-crash-fix.patch

   1 commit 1b0d9bcc5f5cd78b0bb1357d6a11da5d616ad26f
   2 Author: Wout Mertens <Wout.Mertens@gmail.com>
   3 Date:   Thu Jun 11 18:08:13 2020 +0200
   4
   5     fix segfault when using ECDSA keys.
   6
   7     Author: Marc Deslauriers <marc.deslauriers@canonical.com>
   8     Bug-Ubuntu: https://bugs.launchpad.net/bugs/1869512
   9
  10 diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
  11 index 5b13b30..5bf29cc 100644
  12 --- a/ssh-ecdsa.c
  13 +++ b/ssh-ecdsa.c
  14 @@ -46,7 +46,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
  15      u_int len, dlen;
  16      Buffer b, bb;
  17  #if OPENSSL_VERSION_NUMBER >= 0x10100005L
  18 -       BIGNUM *r, *s;
  19 +       BIGNUM *r = NULL, *s = NULL;
  20  #endif
  21
  22      if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
  23 @@ -137,20 +137,27 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
  24
  25      /* parse signature */
  26      if ((sig = ECDSA_SIG_new()) == NULL)
  27 -        pamsshagentauth_fatal("ssh_ecdsa_verify: DSA_SIG_new failed");
  28 +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_new failed");
  29
  30      pamsshagentauth_buffer_init(&b);
  31      pamsshagentauth_buffer_append(&b, sigblob, len);
  32  #if OPENSSL_VERSION_NUMBER < 0x10100005L
  33      if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
  34          (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
  35 +        pamsshagentauth_fatal("ssh_ecdsa_verify:"
  36 +            "pamsshagentauth_buffer_get_bignum2_ret failed");
  37  #else
  38 -    DSA_SIG_get0(sig, &r, &s);
  39 +    if ((r = BN_new()) == NULL)
  40 +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed");
  41 +    if ((s = BN_new()) == NULL)
  42 +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed");
  43      if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) ||
  44          (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1))
  45 -#endif
  46          pamsshagentauth_fatal("ssh_ecdsa_verify:"
  47              "pamsshagentauth_buffer_get_bignum2_ret failed");
  48 +    if (ECDSA_SIG_set0(sig, r, s) != 1)
  49 +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_set0 failed");
  50 +#endif
  51
  52      /* clean up */
  53      memset(sigblob, 0, len);