merge fixes from PuTTY import.c toint() from misc.c (revids are from hggit conversion) changeset: 4620:60a336a6c85c user: Simon Tatham <[email protected]> date: Thu Feb 25 20:26:33 2016 +0000 files: import.c description: Fix potential segfaults in reading OpenSSH's ASN.1 key format. The length coming back from ber_read_id_len might have overflowed, so treat it as potentially negative. Also, while I'm here, accumulate it inside ber_read_id_len as an unsigned, so as to avoid undefined behaviour on integer overflow, and toint() it before return. Thanks to Hanno Böck for spotting this, with the aid of AFL. (cherry picked from commit 5b7833cd474a24ec098654dcba8cb9509f3bf2c1) Conflicts: import.c (cherry-picker's note: resolving the conflict involved removing an entire section of the original commit which fixed ECDSA code not present on this branch) changeset: 4619:9c6c638d98d8 user: Simon Tatham <[email protected]> date: Sun Jul 14 10:45:54 2013 +0000 files: import.c ssh.c sshdss.c sshpubk.c sshrsa.c description: Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918] changeset: 4618:3957829f24d3 user: Simon Tatham <[email protected]> date: Mon Jul 08 22:36:04 2013 +0000 files: import.c sshdss.c sshrsa.c description: Add an assortment of extra safety checks. [originally from svn r9896] changeset: 4617:2cddee0bce12 user: Jacob Nevins <[email protected]> date: Wed Dec 07 00:24:45 2005 +0000 files: import.c description: Institutional failure to memset() things pointed at rather than pointers. Things should now be zeroed and memory not leaked. Spotted by Brant Thomsen. [originally from svn r6476] changeset: 4616:24ac78a9c71d user: Simon Tatham <[email protected]> date: Wed Feb 11 13:58:27 2004 +0000 files: import.c description: Jacob's last-minute testing found a couple of trivial bugs in import.c, and my attempts to reproduce them in cmdgen found another one there :-) [originally from svn r3847] changeset: 4615:088d39a73db0 user: Simon Tatham <[email protected]> date: Thu Jan 22 18:52:49 2004 +0000 files: import.c description: Placate some gcc warnings. [originally from svn r3761] changeset: 4614:e4288bad4d93 parent: 1758:108b8924593d user: Simon Tatham <[email protected]> date: Fri Oct 03 21:21:23 2003 +0000 files: import.c description: My ASN.1 decoder returned wrong IDs for anything above 0x1E! Good job it's never had to yet. Ahem. [originally from svn r3479]

271       555
390       855
508      1161
631      1605
749      2117
871      2687
991      3329
1108      4084
1231      4786
1351      5624
1470      6392
1586      7364
1710      8218
1830      9255
1951     10217
2067     11461
2191     12463
2308     13677
2430     14800
2551     16232
2671     17460
2791     18899
2902     20247
3028     21902
3151     23240
3267     24927
3391     26441
3511     28277
3631     29838
3749     31751
3869     33673
3989     35431
4111     37518
4231     39426
4349     41504
4471     43567
4591     45786
4711     47876
4831     50299
4951     52427
5071     54785
5189     57241
5307     59730
5431     62194
5551     64761
5670     67322
5789     70073
5907     72663
6030     75437
6151     78242
6268     81202
6389     83948
6509     86985
6631     89903
6747     93184
6869     96044
6991     99286
7109    102395
7229    105917
7351    108940
7470    112490
7589    115702
7711    119508
7831    122632
7951    126410
8071    129808
8190    133895
8311    137146
8431    141218
8549    144732
8667    149131
8790    152462
8911    156754
9030    160479
9149    165138
9271    168601
9391    173185
9511    176988
9627    181976
9751    185539
9870    190388
9991    194335
10110    199605
10228    203298