From d373555d64ec46f20eb090afcb87f1f03c2ced0b Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 30 Oct 2026 04:39:16 +0000 Subject: [PATCH] upstream: only replace prior auth_opts if merging later ones succeeds. Part of fix for server fatal() with inconsistent log message when `AuthenticationMethods publickey,publickey` fails on the second key because of inconsistent authentication options. Anthropic ANT-2026-UES5TKX0 OpenBSD-Commit-ID: cb2818d6209c227c79a785544ee964384471ddfe --- auth.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/auth.c b/auth.c index a4a37c11a..d48815ba4 100644 --- a/auth.c +++ b/auth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.c,v 1.165 2026/07/21 06:17:42 djm Exp $ */ +/* $OpenBSD: auth.c,v 1.166 2026/10/30 04:39:16 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -755,14 +755,15 @@ auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote) int auth_activate_options(struct ssh *ssh, struct sshauthopt *opts) { - struct sshauthopt *old = auth_opts; + struct sshauthopt *old = auth_opts, *merged; const char *emsg = NULL; debug_f("setting new authentication options"); - if ((auth_opts = sshauthopt_merge(old, opts, &emsg)) == NULL) { + if ((merged = sshauthopt_merge(old, opts, &emsg)) == NULL) { error("Inconsistent authentication options: %s", emsg); return -1; } + auth_opts = merged; sshauthopt_free(old); return 0; }