Bug 32175
| Summary: | ssh-keygen -p core dumps | ||
|---|---|---|---|
| Product: | Base System | Reporter: | AnarCat <AnarCat> |
| Component: | bin | Assignee: | Brian Feldman <green> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | 4.4-STABLE | ||
| Hardware: | Any | ||
| OS: | Any | ||
|
Description
AnarCat
2001-11-21 21:50:00 UTC
Printing the comment is the source of the crash.
The error appears to be in /usr/src/crypto/openssh/authfile.c
*** authfile.c.orig Thu Dec 20 01:17:00 2001
--- authfile.c Thu Dec 20 01:21:33 2001
***************
*** 556,562 ****
lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
if (pub == NULL) {
/* closes fd */
! return key_load_private_pem(fd, KEY_UNSPEC, passphrase,
NULL);
} else {
/* it's a SSH v1 key if the public key part is readable
*/
key_free(pub);
--- 556,562 ----
lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
if (pub == NULL) {
/* closes fd */
! return key_load_private_pem(fd, KEY_UNSPEC, passphrase,
commentp);
} else {
/* it's a SSH v1 key if the public key part is readable
*/
key_free(pub);
commentp is the address of a pointer to a heap? allocated
string (for the comment). key_load_private_pem will
allocate memory and intialise commentp, if it gets
a non-null value.
As authfile.c is part of libssl someone who knows about
this stuff should verify this fix. Because of this I
present an alternative workaround.
*** ssh-keygen.c.orig Thu Dec 20 01:16:52 2001
--- ssh-keygen.c Thu Dec 20 01:20:49 2001
***************
*** 456,462 ****
void
do_change_passphrase(struct passwd *pw)
{
! char *comment;
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
Key *private;
--- 456,462 ----
void
do_change_passphrase(struct passwd *pw)
{
! char *comment = NULL;
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
Key *private;
This only affects ssh-keygen. The offending printf survives
the null pointer, as does the xfree() later in the function.
Call tree:
ssh-keygen.c: 457:void do_change_passphrase(struct passwd *pw)
477:private = key_load_private(identity_file, old_passphrase ,
&comment);
authfile.c: 541:Key *key_load_private(const char *filename, const char
*passphrase, char **commentp)
559:return key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
<--- error
435:Key *key_load_private_pem(int fd, int type, const char
*passphrase, char **commentp)
478: if (prv != NULL && commentp)
*commentp = xstrdup(name);
I wasn't sure whether to quote the whole thing here. Perhaps
someone could advise me on "style".
--
ian j hart
s/libssl/libssh/ Must remember to sleep. -- ian j hart Responsible Changed From-To: freebsd-bugs->green Over to the OpenSSH maintainer, who'll probably just pass the work on to Eivind. :-) State Changed From-To: open->feedback Committed to -CURRENT, thanks. On Mon Jan 07, 2002 at 07:56:41AM -0800, green@FreeBSD.org wrote: > > State-Changed-From-To: open->feedback > Committed to -CURRENT, thanks. Fix confirmed on -stable. Please commit fix before release. A. This pr can be closed. State Changed From-To: feedback->closed Originator reports problem solved. |
