commit 564cd2a8926ccb1dca43a535073540935b5e0373
author dtucker@openbsd.org <dtucker@openbsd.org> Tue May 31 23:46:14 2016 +0000
committer Damien Miller <djm@mindrot.org> Wed Jun 08 11:39:31 2016 +1000
tree 3f877d12071ecb79d2ecb5ece122996ae5a78931
parent df820722e40309c9b3f360ea4ed47a584ed74333

upstream commit

Ensure that the client's proposed DH-GEX max value is at
 least as big as the minimum the server will accept.  ok djm@

Upstream-ID: b4b84fa04aab2de7e79a6fee4a6e1c189c0fe775

kexgexs.c

diff --git a/kexgexs.c b/kexgexs.c
index 8c5adf7..3caab12 100644
--- a/kexgexs.c
+++ b/kexgexs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexs.c,v 1.26 2015/12/04 16:41:28 markus Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.27 2016/05/31 23:46:14 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -89,7 +89,7 @@
 	nbits = MIN(DH_GRP_MAX, nbits);
 
 	if (kex->max < kex->min || kex->nbits < kex->min ||
-	    kex->max < kex->nbits) {
+	    kex->max < kex->nbits || kex->max < DH_GRP_MIN) {
 		r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
 		goto out;
 	}