dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: check RSA keys decoded from PEM against our hard size

Browse Source 
limits

Anthropic ANT-2026-YPAO7WLH

OpenBSD-Commit-ID: 905fcd43f5f540a041b317d7bf4b74b0dba22429
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:18:09 +11:00
1 parent 6321396a87
commit 9006a5d709
1 file changed
+16 -1
Download Patch File Download Diff File Expand all files Collapse all files
sshkey.c
+16 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sshkey.c,v 1.167 2026/10/30 03:22:47 djm Exp $ */
/* $OpenBSD: sshkey.c,v 1.168 2026/10/30 09:02:03 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@@ -3552,6 +3552,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
BIO *bio = NULL;
int r;
RSA *rsa = NULL;
const BIGNUM *rsa_n = NULL, *rsa_e = NULL;
EC_KEY *ecdsa = NULL;
if (keyp != NULL)
@@ -3594,6 +3595,20 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
#ifdef DEBUG_PK
RSA_print_fp(stderr, rsa, 8);
#endif
/*
* libcrypto doesn't limit the size of the integers it decodes
* from PEM, and RSA_blinding_on() below computes a modular
* exponentiation using n and e. Apply the same upper bound
* that sshbuf_get_bignum2() enforces for the other key formats
* before doing any arithmetic on the key.
*/
RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL);
if (rsa_n == NULL || rsa_e == NULL ||
BN_num_bits(rsa_n) > SSHBUF_MAX_BIGNUM * 8 ||
BN_num_bits(rsa_e) > SSHBUF_MAX_BIGNUM * 8) {
r = SSH_ERR_KEY_LENGTH;
goto out;
}
if (RSA_blinding_on(rsa, NULL) != 1 ||
EVP_PKEY_set1_RSA(pk, rsa) != 1) {
r = SSH_ERR_LIBCRYPTO_ERROR;