From nobody Fri Feb 21 02:56:25 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YzZX94PKpz5nrS0; Fri, 21 Feb 2025 02:56:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YzZX929d7z3d4L; Fri, 21 Feb 2025 02:56:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740106585; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sMSc+bfptX/XHPHlcI0wQ0EYRlvaioDd9+0lrPMbbb0=; b=hq67+hPla6gdghboidyRuZD59VqJ1jH64dvz8Q+y7GdLHOmDb3gKuEu15yZ54hunuQsJ4Z NkthrYauTdxahIMRswmwQHwMWxlF3NibUSCglWdPxNM6WzXM8eeq6aoH3oxuxPakoaKXfP MmwrXpUXkZoGtHcj5AbdpYhqepE1ZR7/3R/EFLzGnCZVCst3O2ZvhPGSOsWlzAffzdJsde ywnrX/zfrhP6+ofhkRYS72M49YtIoa3mQ+E/g3GWCooBj2VZ8S0iQ/CWI/yop/miGMnxzK QmLsp96XKdAQIJ460GvAaPYh+dV8YXYVqUIwt+9GIER5rP17mKNreZnq9durdQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1740106585; a=rsa-sha256; cv=none; b=HeHv48NVtRstux+KNvM2OoRCgtT9asZk1PDo2Xpv786M+J+HAA4PLX/jhbxjdJs0HtYxMv 0SG2QkrhXXWrByx6I0Mv6vurEwyzFScyhchN3CGTu+mGSPg7jtkXv9UXTKZU3qH8a2USS5 u/SdtkZ75M8mDBCq+ELpzurs/TPORiS/4L8YnDwoJDtC6TkriwZ25UJi1C4HesCt4qD93O j77XT59KPq/qeaJ7/tULjNgaSorsQWDkmFL3FvAhFqDphh7bXUVzaep+JNR4YBQD2GuEt0 13Htqw5qS1vK91OgIumN5oIxU6m3yXxP4fMLSVh6CqYlorJYgba0MNrFv6E7Jg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740106585; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sMSc+bfptX/XHPHlcI0wQ0EYRlvaioDd9+0lrPMbbb0=; b=qFtAB/QF9GMiD3AJBkLow/0C0rlcMkWhEYLH+qpaOk8d+hdKv9LQg5WsejfMNV4ERCbBGn rZevsNJGKlgn1GP2DezflP869P1PDe3Zp6wW7cBBG+OixaH2DDXUK6WDN6tYwEPWmjvcMR vOLKd9NYdrpdwtfTWcUlyvsXjEU1gQJp6sffIsaYLYTyXjSZwsdPuJm2/2L8FEzqCaqP9h HY9ONLqQoK6kdcnWEFtbBDboxZoLPFDMDLTbGGQq22uw7z6hbVcnYIepduJJjAKZ1B8hHz TrV2wc589Mok567hPyEar9jJgW70Q0lxv2iDm+8B7ExOOw/j0z2QJHAhmql9cQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YzZX91WLKz1J5P; Fri, 21 Feb 2025 02:56:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 51L2uPEO079648; Fri, 21 Feb 2025 02:56:25 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 51L2uPGw079645; Fri, 21 Feb 2025 02:56:25 GMT (envelope-from git) Date: Fri, 21 Feb 2025 02:56:25 GMT Message-Id: <202502210256.51L2uPGw079645@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: 1920babc310a - releng/14.2 - ssh: Fix cases where error codes were not correctly set List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.2 X-Git-Reftype: branch X-Git-Commit: 1920babc310ab8ebaa76188decf1aa5ed88e9d84 Auto-Submitted: auto-generated The branch releng/14.2 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=1920babc310ab8ebaa76188decf1aa5ed88e9d84 commit 1920babc310ab8ebaa76188decf1aa5ed88e9d84 Author: Ed Maste AuthorDate: 2025-02-19 03:03:26 +0000 Commit: Gordon Tetlow CommitDate: 2025-02-21 02:35:04 +0000 ssh: Fix cases where error codes were not correctly set Obtained from: OpenSSH 38df39ecf278 Security: CVE-2025-26465 Security: FreeBSD-SA-25:05.openssh Approved by: so Sponsored by: The FreeBSD Foundation (cherry picked from commit 170059d6d33cf4e890067097f3c0beb3061cabbd) (cherry picked from commit 4ad8c195cf54411e3b3fa0bec227eb83ca078404) --- crypto/openssh/krl.c | 4 +++- crypto/openssh/ssh-agent.c | 5 +++++ crypto/openssh/ssh-sk-client.c | 4 +++- crypto/openssh/sshconnect2.c | 5 ++++- crypto/openssh/sshsig.c | 1 + 5 files changed, 16 insertions(+), 3 deletions(-) diff --git a/crypto/openssh/krl.c b/crypto/openssh/krl.c index e2efdf0667a7..0d0f69534182 100644 --- a/crypto/openssh/krl.c +++ b/crypto/openssh/krl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: krl.c,v 1.59 2023/07/17 05:22:30 djm Exp $ */ +/* $OpenBSD: krl.c,v 1.60 2025/02/18 08:02:48 djm Exp $ */ /* * Copyright (c) 2012 Damien Miller * @@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf) break; case KRL_SECTION_CERT_SERIAL_BITMAP: if (rs->lo - bitmap_start > INT_MAX) { + r = SSH_ERR_INVALID_FORMAT; error_f("insane bitmap gap"); goto out; } @@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp) } if ((krl = ssh_krl_init()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; error_f("alloc failed"); goto out; } diff --git a/crypto/openssh/ssh-agent.c b/crypto/openssh/ssh-agent.c index 67fa376a36ff..5ea283ddaf29 100644 --- a/crypto/openssh/ssh-agent.c +++ b/crypto/openssh/ssh-agent.c @@ -1226,6 +1226,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, "restrict-destination-v00@openssh.com") == 0) { if (*dcsp != NULL) { error_f("%s already set", ext_name); + r = SSH_ERR_INVALID_FORMAT; goto out; } if ((r = sshbuf_froms(m, &b)) != 0) { @@ -1235,6 +1236,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, while (sshbuf_len(b) != 0) { if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) { error_f("too many %s constraints", ext_name); + r = SSH_ERR_INVALID_FORMAT; goto out; } *dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1, @@ -1252,6 +1254,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, } if (*certs != NULL) { error_f("%s already set", ext_name); + r = SSH_ERR_INVALID_FORMAT; goto out; } if ((r = sshbuf_get_u8(m, &v)) != 0 || @@ -1263,6 +1266,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, while (sshbuf_len(b) != 0) { if (*ncerts >= AGENT_MAX_EXT_CERTS) { error_f("too many %s constraints", ext_name); + r = SSH_ERR_INVALID_FORMAT; goto out; } *certs = xrecallocarray(*certs, *ncerts, *ncerts + 1, @@ -1759,6 +1763,7 @@ process_ext_session_bind(SocketEntry *e) /* record new key/sid */ if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) { error_f("too many session IDs recorded"); + r = -1; goto out; } e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids, diff --git a/crypto/openssh/ssh-sk-client.c b/crypto/openssh/ssh-sk-client.c index 321fe53a2d91..06fad22134fb 100644 --- a/crypto/openssh/ssh-sk-client.c +++ b/crypto/openssh/ssh-sk-client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-sk-client.c,v 1.12 2022/01/14 03:34:00 djm Exp $ */ +/* $OpenBSD: ssh-sk-client.c,v 1.13 2025/02/18 08:02:48 djm Exp $ */ /* * Copyright (c) 2019 Google LLC * @@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device, } if ((srk = calloc(1, sizeof(*srk))) == NULL) { error_f("calloc failed"); + r = SSH_ERR_ALLOC_FAIL; goto out; } srk->key = key; @@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device, if ((tmp = recallocarray(srks, nsrks, nsrks + 1, sizeof(*srks))) == NULL) { error_f("recallocarray keys failed"); + r = SSH_ERR_ALLOC_FAIL; goto out; } debug_f("srks[%zu]: %s %s uidlen %zu", nsrks, diff --git a/crypto/openssh/sshconnect2.c b/crypto/openssh/sshconnect2.c index 745c2a0517f3..51079f067d8a 100644 --- a/crypto/openssh/sshconnect2.c +++ b/crypto/openssh/sshconnect2.c @@ -101,7 +101,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) options.required_rsa_size)) != 0) fatal_r(r, "Bad server host key"); if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, - xxx_conn_info) == -1) + xxx_conn_info) != 0) fatal("Host key verification failed."); return 0; } @@ -700,6 +700,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) { debug_f("server sent unknown pkalg %s", pkalg); + r = SSH_ERR_INVALID_FORMAT; goto done; } if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { @@ -710,6 +711,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) error("input_userauth_pk_ok: type mismatch " "for decoded key (received %d, expected %d)", key->type, pktype); + r = SSH_ERR_INVALID_FORMAT; goto done; } @@ -729,6 +731,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) SSH_FP_DEFAULT); error_f("server replied with unknown key: %s %s", sshkey_type(key), fp == NULL ? "" : fp); + r = SSH_ERR_INVALID_FORMAT; goto done; } ident = format_identity(id); diff --git a/crypto/openssh/sshsig.c b/crypto/openssh/sshsig.c index 470b286a3a98..057e1df02381 100644 --- a/crypto/openssh/sshsig.c +++ b/crypto/openssh/sshsig.c @@ -874,6 +874,7 @@ cert_filter_principals(const char *path, u_long linenum, } if ((principals = sshbuf_dup_string(nprincipals)) == NULL) { error_f("buffer error"); + r = SSH_ERR_ALLOC_FAIL; goto out; } /* success */