You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
31 lines
1.1 KiB
31 lines
1.1 KiB
7 years ago
|
commit 0fb1a617a07b8df5de188dd5a0c8bf293d4bfc0e
|
||
|
|
Author: markus@openbsd.org <markus@openbsd.org>
|
||
|
|
Date: Sat Mar 11 13:07:35 2017 +0000
|
||
|
|
|
||
|
|
upstream commit
|
||
|
|
|
||
|
|
Don't count the initial block twice when computing how
|
||
|
|
many bytes to discard for the work around for the attacks against CBC-mode.
|
||
|
|
ok djm@; report from Jean Paul, Kenny, Martin and Torben @ RHUL
|
||
|
|
|
||
|
|
Upstream-ID: f445f509a4e0a7ba3b9c0dae7311cb42458dc1e2
|
||
|
|
|
||
|
|
diff --git a/packet.c b/packet.c
|
||
|
|
index 01e2d45..2f3a2ec 100644
|
||
|
|
--- a/packet.c
|
||
|
|
+++ b/packet.c
|
||
|
|
@@ -1850,11 +1850,11 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
|
||
|
|
if (r != SSH_ERR_MAC_INVALID)
|
||
|
|
goto out;
|
||
|
|
logit("Corrupted MAC on input.");
|
||
|
|
- if (need > PACKET_MAX_SIZE)
|
||
|
|
+ if (need + block_size > PACKET_MAX_SIZE)
|
||
|
|
return SSH_ERR_INTERNAL_ERROR;
|
||
|
|
return ssh_packet_start_discard(ssh, enc, mac,
|
||
|
|
sshbuf_len(state->incoming_packet),
|
||
|
|
- PACKET_MAX_SIZE - need);
|
||
|
|
+ PACKET_MAX_SIZE - need - block_size);
|
||
|
|
}
|
||
|
|
/* Remove MAC from input buffer */
|
||
|
|
DBG(debug("MAC #%d ok", state->p_read.seqnr));
|