Differences From Artifact [bd9ce42f76]:

• File ssh.c — part of check-in [4614439a8b] at 2004-08-17 09:08:05 on branch trunk — Someone complained that their keyboard-interactive password prompt was being truncated - it was from OpenSSH on HP/UX and had all sorts of stuff in it ("last successful login" etc). Bodged it by bumping up the space allocated in the fixed array for a password prompt. Also added an indication that the prompt is being truncated, as required by draft-ietf-secsh-auth-kbdinteract-06. (NB that before this checkin, there was a more-or-less harmless buffer overread where if we ever received a keyboard-interactive prompt with echo=1, we'd probably spew goo on the terminal; fixed now.) (user: jacob size: 202606)

To Artifact [e3103c5d98]:

• File ssh.c — part of check-in [bea2fe89de] at 2004-08-28 11:51:26 on branch trunk — More sensible error handling when we receive an SSH1 public key modulus of zero (!!), and also a robustness fix in ssh1_rdpkt which I happened to notice while debugging that. (user: simon size: 202765)

822
823
824
825
826
827
828






829
830
831
832
833
834
835

	st->len = (st->len << 8) + **data;
	(*data)++, (*datalen)--;
    }

    st->pad = 8 - (st->len % 8);
    st->biglen = st->len + st->pad;
    ssh->pktin.length = st->len - 5;







    if (ssh->pktin.maxlen < st->biglen) {
	ssh->pktin.maxlen = st->biglen;
	ssh->pktin.data = sresize(ssh->pktin.data, st->biglen + APIEXTRA,
				  unsigned char);
    }

>
>
>
>
>
>

822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841

	st->len = (st->len << 8) + **data;
	(*data)++, (*datalen)--;
    }

    st->pad = 8 - (st->len % 8);
    st->biglen = st->len + st->pad;
    ssh->pktin.length = st->len - 5;

    if (st->biglen < 0) {
        bombout(("Extremely large packet length from server suggests"
		 " data stream corruption"));
        crStop(0);
    }

    if (ssh->pktin.maxlen < st->biglen) {
	ssh->pktin.maxlen = st->biglen;
	ssh->pktin.data = sresize(ssh->pktin.data, st->biglen + APIEXTRA,
				  unsigned char);
    }

2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445

	bombout(("SSH1 public key packet stopped before random cookie"));
	crStop(0);
    }
    memcpy(cookie, ptr, 8);

    if (!ssh1_pkt_getrsakey(ssh, &servkey, &s->keystr1) ||
	!ssh1_pkt_getrsakey(ssh, &hostkey, &s->keystr2)) {	
	bombout(("SSH1 public key packet stopped before public keys"));
	crStop(0);
    }

    /*
     * Log the host key fingerprint.
     */
    {

|

2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451

	bombout(("SSH1 public key packet stopped before random cookie"));
	crStop(0);
    }
    memcpy(cookie, ptr, 8);

    if (!ssh1_pkt_getrsakey(ssh, &servkey, &s->keystr1) ||
	!ssh1_pkt_getrsakey(ssh, &hostkey, &s->keystr2)) {	
	bombout(("Failed to read SSH1 public keys from public key packet"));
	crStop(0);
    }

    /*
     * Log the host key fingerprint.
     */
    {