LILiK
/
openwrt-packages-dist
5
0
Fork 0
Code Issues 0 Pull Requests 0 Projects 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6334 Commits
1 Branch
46 MiB
Tree: 0c60737b38
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '0c60737b38'
${ noResults }
openwrt-packages-dist/net/openssh/patches/101-Unregister-the-KEXINIT-...

18 lines
573 B
Raw Normal View History

openssh: Unregister the KEXINIT handler after message has been received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause allocation of up to 128MB -- until the connection is closed. Reported by shilei-c at 360.cn https://github.com/openssh/openssh-portable/commit/ec165c392ca54317dbe3064a8c200de6531e89ad Signed-off-by: Peter Wagner <tripolar@gmx.at>
8 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
 
  1. diff --git a/kex.c b/kex.c

  2. index 50c7a0f..d09c27b 100644

  3. --- a/kex.c

  4. +++ b/kex.c

  5. @@ -1,4 +1,4 @@

  6. -/* $OpenBSD: kex.c,v 1.118 2016/05/02 10:26:04 djm Exp $ */

  7. +/* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */

  8.  /*
  9.   * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  10.   *
  11. @@ -472,6 +472,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)

  12.  	if (kex == NULL)
  13.  		return SSH_ERR_INVALID_ARGUMENT;
  14.  
  15. +	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);

  16.  	ptr = sshpkt_ptr(ssh, &dlen);
  17.  	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
  18.  		return r;