Mercurial > dropbear
diff signkey.c @ 1362:74a22c562cdf fuzz
Fix null pointer dereference found by libfuzzer
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sun, 21 May 2017 18:53:09 +0800 |
| parents | 750ec4ec4cbe |
| children | ddfcadca3c4c |
line wrap: on
line diff
--- a/signkey.c Sun May 21 10:54:11 2017 +0800 +++ b/signkey.c Sun May 21 18:53:09 2017 +0800 @@ -102,7 +102,8 @@ return DROPBEAR_SIGNKEY_NONE; } -/* Returns a pointer to the key part specific to "type" */ +/* Returns a pointer to the key part specific to "type". +Be sure to check both (ret != NULL) and (*ret != NULL) */ void ** signkey_key_ptr(sign_key *key, enum signkey_type type) { switch (type) { @@ -294,7 +295,7 @@ #if DROPBEAR_ECDSA if (signkey_is_ecdsa(type)) { ecc_key **eck = (ecc_key**)signkey_key_ptr(key, type); - if (eck) { + if (eck && *eck) { buf_put_ecdsa_pub_key(pubkeys, *eck); } } @@ -331,7 +332,7 @@ #if DROPBEAR_ECDSA if (signkey_is_ecdsa(type)) { ecc_key **eck = (ecc_key**)signkey_key_ptr(key, type); - if (eck) { + if (eck && *eck) { buf_put_ecdsa_priv_key(buf, *eck); TRACE(("leave buf_put_priv_key: ecdsa done")) return; @@ -495,7 +496,7 @@ #if DROPBEAR_ECDSA if (signkey_is_ecdsa(type)) { ecc_key **eck = (ecc_key**)signkey_key_ptr(key, type); - if (eck) { + if (eck && *eck) { buf_put_ecdsa_sign(sigblob, *eck, data_buf); } }