- deraadt@cvs.openbsd.org 2006/03/25 18:56:55

[openssh.git] / bufaux.c

diff --git a/bufaux.c b/bufaux.c
index cbe77d5ae9f5b860bf8b337009931d054eb70691..21a2badf13c4f6db3b798c3731a5cec75b54e8d9 100644 (file)
--- a/bufaux.c
+++ b/bufaux.c
@@ -1,3 +1,4 @@
+/* $OpenBSD: bufaux.c,v 1.40 2006/03/25 18:56:54 deraadt Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -37,7 +38,6 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: bufaux.c,v 1.33 2004/10/29 23:56:17 djm Exp $");
 
 #include <openssl/bn.h>
 #include "bufaux.h"
@@ -63,6 +63,7 @@ buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
        if (oi != bin_size) {
                error("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d",
                    oi, bin_size);
+               xfree(buf);
                return (-1);
        }
 
@@ -70,7 +71,7 @@ buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
        PUT_16BIT(msg, bits);
        buffer_append(buffer, msg, 2);
        /* Store the binary data. */
-       buffer_append(buffer, (char *)buf, oi);
+       buffer_append(buffer, buf, oi);
 
        memset(buf, 0, bin_size);
        xfree(buf);
@@ -151,10 +152,10 @@ buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
                return (-1);
        }
        buf = xmalloc(bytes);
-       buf[0] = '\0';
+       buf[0] = 0x00;
        /* Get the value of in binary */
        oi = BN_bn2bin(value, buf+1);
-       if (oi != bytes-1) {
+       if (oi < 0 || (u_int)oi != bytes - 1) {
                error("buffer_put_bignum2_ret: BN_bn2bin() failed: "
                    "oi %d != bin_size %d", oi, bytes);
                xfree(buf);
@@ -179,7 +180,7 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
 {
        u_int len;
        u_char *bin;
-       
+
        if ((bin = buffer_get_string_ret(buffer, &len)) == NULL) {
                error("buffer_get_bignum2_ret: invalid bignum");
                return (-1);
@@ -187,10 +188,12 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
 
        if (len > 0 && (bin[0] & 0x80)) {
                error("buffer_get_bignum2_ret: negative numbers not supported");
+               xfree(bin);
                return (-1);
        }
        if (len > 8 * 1024) {
                error("buffer_get_bignum2_ret: cannot handle BN of size %d", len);
+               xfree(bin);
                return (-1);
        }
        BN_bin2bn(bin, len, value);