commit 4a4b75adac862029a1064577eb5af299b1580cdd
author dtucker@openbsd.org <dtucker@openbsd.org> Fri Mar 10 02:59:51 2017 +0000
committer Darren Tucker <dtucker@zip.com.au> Fri Mar 10 15:23:17 2017 +1100
tree 97ef3deb8f9ccf0a9c6009baa7a0ddf5edf9fee7
parent bee0167be2340d8de4bdc1ab1064ec957c85a447

upstream commit

Validate digest arg in ssh_digest_final; from jjelen at
redhat.com via bz#2687, ok djm@

Upstream-ID: dbe5494dfddfe523fab341a3dab5a79e7338f878

digest-openssl.c

diff --git a/digest-openssl.c b/digest-openssl.c
index 13b63c2..c55ceb9 100644
--- a/digest-openssl.c
+++ b/digest-openssl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: digest-openssl.c,v 1.5 2014/12/21 22:27:56 djm Exp $ */
+/* $OpenBSD: digest-openssl.c,v 1.6 2017/03/10 02:59:51 dtucker Exp $ */
 /*
  * Copyright (c) 2013 Damien Miller <djm@mindrot.org>
  *
@@ -158,7 +158,7 @@
 	const struct ssh_digest *digest = ssh_digest_by_alg(ctx->alg);
 	u_int l = dlen;
 
-	if (dlen > UINT_MAX)
+	if (digest == NULL || dlen > UINT_MAX)
 		return SSH_ERR_INVALID_ARGUMENT;
 	if (dlen < digest->digest_len) /* No truncation allowed */
 		return SSH_ERR_INVALID_ARGUMENT;