From owner-svn-ports-head@freebsd.org Sun Feb 21 11:56:42 2021 Return-Path: Delivered-To: svn-ports-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 74D25554773; Sun, 21 Feb 2021 11:56:42 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Dk3gt2tCQz4bCb; Sun, 21 Feb 2021 11:56:42 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 55BAB1230A; Sun, 21 Feb 2021 11:56:42 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 11LBugEL015818; Sun, 21 Feb 2021 11:56:42 GMT (envelope-from matthew@FreeBSD.org) Received: (from matthew@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 11LBufTg015817; Sun, 21 Feb 2021 11:56:41 GMT (envelope-from matthew@FreeBSD.org) Message-Id: <202102211156.11LBufTg015817@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: matthew set sender to matthew@FreeBSD.org using -f From: Matthew Seaman Date: Sun, 21 Feb 2021 11:56:41 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r566222 - in head/security/pam_ssh_agent_auth: . files X-SVN-Group: ports-head X-SVN-Commit-Author: matthew X-SVN-Commit-Paths: in head/security/pam_ssh_agent_auth: . files X-SVN-Commit-Revision: 566222 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Feb 2021 11:56:42 -0000 Author: matthew Date: Sun Feb 21 11:56:41 2021 New Revision: 566222 URL: https://svnweb.freebsd.org/changeset/ports/566222 Log: Fix segfault when handling ECDSA keys Import patch by Marc Deslauriers from the Ubuntu package of pam_ssh_agent_auth Ref: https://github.com/jbeverly/pam_ssh_agent_auth/pull/24/files https://github.com/jbeverly/pam_ssh_agent_auth/issues/18 https://bugs.launchpad.net/ubuntu/+source/pam-ssh-agent-auth/+bug/1869512 PR: 253693 Submitted by: Matt Obtained from: Marc Deslauriers , Ubuntu Added: head/security/pam_ssh_agent_auth/files/patch-ssh-ecdsa.c (contents, props changed) Modified: head/security/pam_ssh_agent_auth/Makefile Modified: head/security/pam_ssh_agent_auth/Makefile ============================================================================== --- head/security/pam_ssh_agent_auth/Makefile Sun Feb 21 11:52:44 2021 (r566221) +++ head/security/pam_ssh_agent_auth/Makefile Sun Feb 21 11:56:41 2021 (r566222) @@ -3,6 +3,7 @@ PORTNAME= pam_ssh_agent_auth PORTVERSION= 0.10.4 +PORTREVISION= 1 CATEGORIES= security MAINTAINER= matthew@FreeBSD.org Added: head/security/pam_ssh_agent_auth/files/patch-ssh-ecdsa.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/pam_ssh_agent_auth/files/patch-ssh-ecdsa.c Sun Feb 21 11:56:41 2021 (r566222) @@ -0,0 +1,42 @@ +--- ssh-ecdsa.c.orig 2019-07-08 16:36:13 UTC ++++ ssh-ecdsa.c +@@ -46,7 +46,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *l + u_int len, dlen; + Buffer b, bb; + #if OPENSSL_VERSION_NUMBER >= 0x10100005L +- BIGNUM *r, *s; ++ BIGNUM *r = NULL, *s = NULL; + #endif + + if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) { +@@ -137,20 +137,27 @@ ssh_ecdsa_verify(const Key *key, const u_char *signatu + + /* parse signature */ + if ((sig = ECDSA_SIG_new()) == NULL) +- pamsshagentauth_fatal("ssh_ecdsa_verify: DSA_SIG_new failed"); ++ pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_new failed"); + + pamsshagentauth_buffer_init(&b); + pamsshagentauth_buffer_append(&b, sigblob, len); + #if OPENSSL_VERSION_NUMBER < 0x10100005L + if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) || + (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1)) ++ pamsshagentauth_fatal("ssh_ecdsa_verify:" ++ "pamsshagentauth_buffer_get_bignum2_ret failed"); + #else +- DSA_SIG_get0(sig, &r, &s); ++ if ((r = BN_new()) == NULL) ++ pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); ++ if ((s = BN_new()) == NULL) ++ pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); + if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) || + (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1)) +-#endif + pamsshagentauth_fatal("ssh_ecdsa_verify:" + "pamsshagentauth_buffer_get_bignum2_ret failed"); ++ if (ECDSA_SIG_set0(sig, r, s) != 1) ++ pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_set0 failed"); ++#endif + + /* clean up */ + memset(sigblob, 0, len);