From f1fe0c7d8dc216665ea8a9d86eaa28d5bb99b963 Mon Sep 17 00:00:00 2001 From: Simon Tatham Date: Sun, 5 May 2019 08:32:49 +0100 Subject: [PATCH] openssh_new_read: fix misaimed null pointer check. If the input key_wanted field were set to an out-of-range value, the parent structure retkey would not become NULL as a whole: instead, its field 'key' would never be set to a non-null pointer. So I was testing the wrong pointer. Fortunately, this couldn't have come up, because we don't actually have any support yet for loading the nth key from an OpenSSH new-style key file containing more than one. So key_wanted was always set to 0 by load_openssh_new_key(), which also checked that the file's key count was exactly 1 (guarding against the possibility that even 0 might have been an out-of-range index). --- import.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/import.c b/import.c index a11d1602..61f14371 100644 --- a/import.c +++ b/import.c @@ -1442,7 +1442,7 @@ static ssh2_userkey *openssh_new_read( } } - if (!retkey) { + if (!retkey->key) { errmsg = "key index out of range"; goto error; }