merge fixes from PuTTY import.c toint() from misc.c (revids are from hggit conversion) changeset: 4620:60a336a6c85c user: Simon Tatham <[email protected]> date: Thu Feb 25 20:26:33 2016 +0000 files: import.c description: Fix potential segfaults in reading OpenSSH's ASN.1 key format. The length coming back from ber_read_id_len might have overflowed, so treat it as potentially negative. Also, while I'm here, accumulate it inside ber_read_id_len as an unsigned, so as to avoid undefined behaviour on integer overflow, and toint() it before return. Thanks to Hanno Böck for spotting this, with the aid of AFL. (cherry picked from commit 5b7833cd474a24ec098654dcba8cb9509f3bf2c1) Conflicts: import.c (cherry-picker's note: resolving the conflict involved removing an entire section of the original commit which fixed ECDSA code not present on this branch) changeset: 4619:9c6c638d98d8 user: Simon Tatham <[email protected]> date: Sun Jul 14 10:45:54 2013 +0000 files: import.c ssh.c sshdss.c sshpubk.c sshrsa.c description: Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918] changeset: 4618:3957829f24d3 user: Simon Tatham <[email protected]> date: Mon Jul 08 22:36:04 2013 +0000 files: import.c sshdss.c sshrsa.c description: Add an assortment of extra safety checks. [originally from svn r9896] changeset: 4617:2cddee0bce12 user: Jacob Nevins <[email protected]> date: Wed Dec 07 00:24:45 2005 +0000 files: import.c description: Institutional failure to memset() things pointed at rather than pointers. Things should now be zeroed and memory not leaked. Spotted by Brant Thomsen. [originally from svn r6476] changeset: 4616:24ac78a9c71d user: Simon Tatham <[email protected]> date: Wed Feb 11 13:58:27 2004 +0000 files: import.c description: Jacob's last-minute testing found a couple of trivial bugs in import.c, and my attempts to reproduce them in cmdgen found another one there :-) [originally from svn r3847] changeset: 4615:088d39a73db0 user: Simon Tatham <[email protected]> date: Thu Jan 22 18:52:49 2004 +0000 files: import.c description: Placate some gcc warnings. [originally from svn r3761] changeset: 4614:e4288bad4d93 parent: 1758:108b8924593d user: Simon Tatham <[email protected]> date: Fri Oct 03 21:21:23 2003 +0000 files: import.c description: My ASN.1 decoder returned wrong IDs for anything above 0x1E! Good job it's never had to yet. Ahem. [originally from svn r3479]

271       560
391       870
511      1159
631      1605
750      2111
871      2737
991      3361
1111      4054
1231      4778
1351      5600
1471      6404
1591      7323
1710      8255
1831      9239
1948     10257
2070     11397
2190     12531
2308     13665
2429     14870
2550     16175
2671     17539
2787     18879
2911     20350
3031     21807
3150     23415
3270     24897
3388     26567
3511     28205
3627     30076
3751     31744
3869     33657
3991     35425
4111     37522
4229     39363
4351     41503
4470     43491
4590     45827
4711     47795
4828     50166
4951     52318
5070     54911
5191     57036
5308     58237
5431     60248
5551     62678
5671     64786
5791     67294
5908     69343
6031     71607
6151     74166
6271     76590
6391     78734
6511     81175
6631     83742
6750     86403
6868     88873
6990     91150
7110     94211
7228     96922
7351     99445
7469    102216
7589    104968
7711    108113
7827    110758
7950    113714
8071    116511
8186    119643
8310    122679
8425    125581
8551    128715
8669    131778
8788    135116
8910    138138
9031    141628
9148    144754
9268    148367
9391    151551
9511    155033
9631    158652
9751    162125
9871    165248
9988    168627
10111    172427
10231    176412