nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-10 09:58:01 +00:00
Code Issues Projects Releases Wiki Activity

Handle packets with no type byte by returning SSH_MSG_UNIMPLEMENTED.

Browse Source 
The previous assertion failure is obviously wrong, but RFC 4253 doesn't
explicitly declare them to be a protocol error.  Currently, the incoming
packet isn't logged, which might cause some confusion for log parsers.

Bug found with the help of afl-fuzz.
This commit is contained in:
Ben Harris 2015-10-17 21:00:31 +01:00
parent 1d20c1b396
commit 5471539a67
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ssh.c
View File

@ -364,6 +364,7 @@ static void do_ssh2_authconn(Ssh ssh, const unsigned char *in, int inlen,
struct Packet *pktin);
static void ssh2_channel_check_close(struct ssh_channel *c);
static void ssh_channel_destroy(struct ssh_channel *c);
static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin);
/*
* Buffer management constants. There are several of these for
@ -1834,6 +1835,15 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, const unsigned char **data,
}
}
/*
* RFC 4253 doesn't explicitly say that completely empty packets
* with no type byte are forbidden, so treat them as deserving
* an SSH_MSG_UNIMPLEMENTED.
*/
if (st->pktin->length <= 5) { /* == 5 we hope, but robustness */
ssh2_msg_something_unimplemented(ssh, st->pktin);
crStop(NULL);
}
/*
* pktin->body and pktin->length should identify the semantic
* content of the packet, excluding the initial type byte.