- djm@cvs.openbsd.org 2010/01/30 02:54:53

[openssh.git] / bufbn.c

diff --git a/bufbn.c b/bufbn.c
index 6cf65d372ef60ea8616b89bcad7a701e559083fd..251cd09518c602916962b019bb0dad1496c950b5 100644 (file)
--- a/bufbn.c
+++ b/bufbn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufbn.c,v 1.3 2006/08/03 03:34:41 deraadt Exp $*/
+/* $OpenBSD: bufbn.c,v 1.6 2007/06/02 09:04:58 djm Exp $*/
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -93,7 +93,7 @@ buffer_put_bignum(Buffer *buffer, const BIGNUM *value)
 }
 
 /*
- * Retrieves an BIGNUM from the buffer.
+ * Retrieves a BIGNUM from the buffer.
  */
 int
 buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
@@ -101,7 +101,7 @@ buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
        u_int bits, bytes;
        u_char buf[2], *bin;
 
-       /* Get the number for bits. */
+       /* Get the number of bits. */
        if (buffer_get_ret(buffer, (char *) buf, 2) == -1) {
                error("buffer_get_bignum_ret: invalid length");
                return (-1);
@@ -118,7 +118,10 @@ buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
                return (-1);
        }
        bin = buffer_ptr(buffer);
-       BN_bin2bn(bin, bytes, value);
+       if (BN_bin2bn(bin, bytes, value) == NULL) {
+               error("buffer_get_bignum_ret: BN_bin2bn failed");
+               return (-1);
+       }
        if (buffer_consume_ret(buffer, bytes) == -1) {
                error("buffer_get_bignum_ret: buffer_consume failed");
                return (-1);
@@ -134,7 +137,7 @@ buffer_get_bignum(Buffer *buffer, BIGNUM *value)
 }
 
 /*
- * Stores an BIGNUM in the buffer in SSH2 format.
+ * Stores a BIGNUM in the buffer in SSH2 format.
  */
 int
 buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
@@ -198,11 +201,16 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
                return (-1);
        }
        if (len > 8 * 1024) {
-               error("buffer_get_bignum2_ret: cannot handle BN of size %d", len);
+               error("buffer_get_bignum2_ret: cannot handle BN of size %d",
+                   len);
+               xfree(bin);
+               return (-1);
+       }
+       if (BN_bin2bn(bin, len, value) == NULL) {
+               error("buffer_get_bignum2_ret: BN_bin2bn failed");
                xfree(bin);
                return (-1);
        }
-       BN_bin2bn(bin, len, value);
        xfree(bin);
        return (0);
 }