dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: avoid fatal() if a PKCS#11 key was added multiple times

Browse Source 
(e.g. for multiple certificates) and then subsequently freed. The key-free
code incorrectly assumed that keys were singular.

Anthropic ANT-2026-V7H1QCC4

OpenBSD-Commit-ID: 9a5575d6733d91666dc86de841601d17b483df9f
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:14:07 +11:00
1 parent a76fb3adab
commit a73db88df0
1 file changed
+10 -5
Download Patch File Download Diff File Expand all files Collapse all files
ssh-pkcs11-client.c
+10 -5
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: ssh-pkcs11-client.c,v 1.27 2026/10/30 01:41:01 djm Exp $ */
/* $OpenBSD: ssh-pkcs11-client.c,v 1.28 2026/10/30 04:48:41 djm Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
* Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -480,15 +480,20 @@ pkcs11_key_free(struct sshkey *key)
if ((r = sshkey_putb(key, keyblob)) != 0)
fatal_fr(r, "serialise key");
/* repack keys */
/*
* Remove one record of the key and repack. A key may legitimately be
* recorded more than once, e.g. when pkcs11_make_cert() is called
* repeatedly for the same certificate, so remove the first match only
* and leave any others for the remaining sshkey instances.
*/
for (i = 0; i < helper->nkeyblobs; i++) {
if (sshbuf_equals(keyblob, helper->keyblobs[i]) == 0) {
if (found)
fatal_f("key recorded more than once");
if (!found && sshbuf_equals(keyblob, helper->keyblobs[i]) == 0) {
sshbuf_free(helper->keyblobs[i]);
found = 1;
} else if (found)
helper->keyblobs[i - 1] = helper->keyblobs[i];
}
sshbuf_free(keyblob);
if (found) {
helper->keyblobs = xrecallocarray(helper->keyblobs,
helper->nkeyblobs, helper->nkeyblobs - 1,