- markus@cvs.openbsd.org 2002/02/23 17:59:02

     [kex.c kexdh.c kexgex.c]
     don't allow garbage after payload.

diff --git a/ChangeLog b/ChangeLog
index c1bddc01e9e13631e98fbf88b14ba4464f854b8b..8d5af26bc21f937654fbe8eeab6f5f15f2eb01f0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -23,6 +23,9 @@
    - markus@cvs.openbsd.org 2002/02/22 12:20:34
      [log.c log.h ssh-keyscan.c]
      overwrite fatal() in ssh-keyscan.c; fixes pr 2354; ok provos@
+   - markus@cvs.openbsd.org 2002/02/23 17:59:02
+     [kex.c kexdh.c kexgex.c]
+     don't allow garbage after payload.
 
 20020225
  - (bal) Last AIX patch.  Moved aix_usrinfo() outside of do_setuserconext()

diff --git a/kex.c b/kex.c
index e9f944b05ba92eff4b12e17ddeadfe2ffffd3034..e91b2ee35cd588ac8cd1d3ad781414db9e00e82d 100644 (file)
--- a/kex.c
+++ b/kex.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.45 2002/02/14 23:41:01 markus Exp $");
+RCSID("$OpenBSD: kex.c,v 1.46 2002/02/23 17:59:02 markus Exp $");
 
 #include <openssl/crypto.h>
 
@@ -132,6 +132,7 @@ kex_finish(Kex *kex)
 
        debug("waiting for SSH2_MSG_NEWKEYS");
        packet_read_expect(SSH2_MSG_NEWKEYS);
+       packet_check_eom();
        debug("SSH2_MSG_NEWKEYS received");
 
        kex->done = 1;

diff --git a/kexdh.c b/kexdh.c
index f87d5295211dd7efad97de8a6e2cd2f5e5615f65..2049d6e1b26c3bf2966b37c00d7feac2819f8866 100644 (file)
--- a/kexdh.c
+++ b/kexdh.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kexdh.c,v 1.14 2002/01/31 13:35:11 markus Exp $");
+RCSID("$OpenBSD: kexdh.c,v 1.15 2002/02/23 17:59:02 markus Exp $");
 
 #include <openssl/crypto.h>
 #include <openssl/bn.h>
@@ -220,6 +220,7 @@ kexdh_server(Kex *kex)
        if ((dh_client_pub = BN_new()) == NULL)
                fatal("dh_client_pub == NULL");
        packet_get_bignum2(dh_client_pub);
+       packet_check_eom();
 
 #ifdef DEBUG_KEXDH
        fprintf(stderr, "dh_client_pub= ");

diff --git a/kexgex.c b/kexgex.c
index dc2fa67239340938428419bfb9eb80e649035d62..ac377aafccb055c96f7c18014848ac6f4a27e0e5 100644 (file)
--- a/kexgex.c
+++ b/kexgex.c
@@ -24,7 +24,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kexgex.c,v 1.17 2002/01/31 13:35:11 markus Exp $");
+RCSID("$OpenBSD: kexgex.c,v 1.18 2002/02/23 17:59:02 markus Exp $");
 
 #include <openssl/bn.h>
 
@@ -319,6 +319,7 @@ kexgex_server(Kex *kex)
        if ((dh_client_pub = BN_new()) == NULL)
                fatal("dh_client_pub == NULL");
        packet_get_bignum2(dh_client_pub);
+       packet_check_eom();
 
 #ifdef DEBUG_KEXDH
        fprintf(stderr, "dh_client_pub= ");