From d008d235f3841139daca39efee25cd5423ce31b8 Mon Sep 17 00:00:00 2001 From: Simon Tatham Date: Sun, 23 May 2021 08:59:13 +0100 Subject: [PATCH] Fix tight loop on reading truncated key files. In commit 9cc586e605e3db1 I changed the low-level key-file reading routines like read_header and read_body so that they read from a BinarySource via get_byte(), rather than from a FILE * via fgetc. But I forgot that the two functions don't signal end-of-file the same way, so testing the return value of get_byte() against EOF is pointless and will never match, and conversely, real EOF won't be spotted unless you also examine the error indicator in the BinarySource. As a result, a key file that ends without a trailing newline will cause a tight loop in one of those low-level read routines. --- sshpubk.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sshpubk.c b/sshpubk.c index f7a9bb33..e7197de3 100644 --- a/sshpubk.c +++ b/sshpubk.c @@ -480,7 +480,7 @@ static bool read_header(BinarySource *src, char *header) while (1) { c = get_byte(src); - if (c == '\n' || c == '\r' || c == EOF) + if (c == '\n' || c == '\r' || get_err(src)) return false; /* failure */ if (c == ':') { c = get_byte(src); @@ -503,10 +503,10 @@ static char *read_body(BinarySource *src) while (1) { int c = get_byte(src); - if (c == '\r' || c == '\n' || c == EOF) { - if (c != EOF) { + if (c == '\r' || c == '\n' || get_err(src)) { + if (!get_err(src)) { c = get_byte(src); - if (c != '\r' && c != '\n') + if (c != '\r' && c != '\n' && !get_err(src)) src->pos--; } return strbuf_to_str(buf);