WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

PrepareUserAuthRequestEcc Missing Bounds Checks 

For agent ECC public key parsing, replaced parsing the data by hand with
the GetSkip() and GetStringRef() functions which do bounds checking.

Affected function: PrepareUserAuthRequestEcc.
Issue: F-526
pull/892/head
John Safranek 2026-03-09 14:06:22 -07:00
parent 6638c01bbb
commit 6a3e97d12b
1 changed files with 25 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
src/internal.c
View File

@ -14400,19 +14400,32 @@ static int PrepareUserAuthRequestEcc(WOLFSSH* ssh, word32* payloadSz,
word32 idx = 0;
#ifdef WOLFSSH_AGENT
if (ssh->agentEnabled) {
word32 sz;
const byte* c = (const byte*)authData->sf.publicKey.publicKey;
const byte* publicKey = NULL;
word32 publicKeySz;
ato32(c + idx, &sz);
idx += LENGTH_SZ + sz;
ato32(c + idx, &sz);
idx += LENGTH_SZ + sz;
ato32(c + idx, &sz);
idx += LENGTH_SZ;
c += idx;
idx = 0;
ret = wc_ecc_import_x963(c, sz, &keySig->ks.ecc.key);
ret = GetSkip((const byte*)authData->sf.publicKey.publicKey,
authData->sf.publicKey.publicKeySz, &idx);
if (ret == WS_SUCCESS) {
ret = GetSkip((const byte*)authData->sf.publicKey.publicKey,
authData->sf.publicKey.publicKeySz, &idx);
}
if (ret == WS_SUCCESS) {
ret = GetStringRef(&publicKeySz, &publicKey,
(const byte*)authData->sf.publicKey.publicKey,
authData->sf.publicKey.publicKeySz, &idx);
}
if (ret == WS_SUCCESS) {
ret = wc_ecc_import_x963(publicKey, publicKeySz,
&keySig->ks.ecc.key);
}
if (ret != 0) {
WLOG(WS_LOG_ERROR,
"wc_ecc_import_x963 failed, ret = %d", ret);
ret = WS_ECC_E;
}
else {
ret = WS_SUCCESS;
}
}
else
#endif