Upgrade to OpenSSH 6.5p1.

1 files changed, 75 insertions, 1 deletions

diff --git a/crypto/openssh/bufaux.c b/crypto/openssh/bufaux.c
index de5b3ca..9401fe1 100644
--- a/crypto/openssh/bufaux.c
+++ b/crypto/openssh/bufaux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.52 2013/07/12 00:19:58 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.54 2014/01/12 08:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -45,6 +45,7 @@
 
 #include <string.h>
 #include <stdarg.h>
+#include <stdlib.h>
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -314,3 +315,76 @@ buffer_put_char(Buffer *buffer, int value)
 
 	buffer_append(buffer, &ch, 1);
 }
+
+/* Pseudo bignum functions */
+
+void *
+buffer_get_bignum2_as_string_ret(Buffer *buffer, u_int *length_ptr)
+{
+	u_int len;
+	u_char *bin, *p, *ret;
+
+	if ((p = bin = buffer_get_string_ret(buffer, &len)) == NULL) {
+		error("%s: invalid bignum", __func__);
+		return NULL;
+	}
+
+	if (len > 0 && (bin[0] & 0x80)) {
+		error("%s: negative numbers not supported", __func__);
+		free(bin);
+		return NULL;
+	}
+	if (len > 8 * 1024) {
+		error("%s: cannot handle BN of size %d", __func__, len);
+		free(bin);
+		return NULL;
+	}
+	/* Skip zero prefix on numbers with the MSB set */
+	if (len > 1 && bin[0] == 0x00 && (bin[1] & 0x80) != 0) {
+		p++;
+		len--;
+	}
+	ret = xmalloc(len);
+	memcpy(ret, p, len);
+	memset(p, '\0', len);
+	free(bin);
+	return ret;
+}
+
+void *
+buffer_get_bignum2_as_string(Buffer *buffer, u_int *l)
+{
+	void *ret = buffer_get_bignum2_as_string_ret(buffer, l);
+
+	if (ret == NULL)
+		fatal("%s: buffer error", __func__);
+	return ret;
+}
+
+/*
+ * Stores a string using the bignum encoding rules (\0 pad if MSB set).
+ */
+void
+buffer_put_bignum2_from_string(Buffer *buffer, const u_char *s, u_int l)
+{
+	u_char *buf, *p;
+	int pad = 0;
+
+	if (l > 8 * 1024)
+		fatal("%s: length %u too long", __func__, l);
+	p = buf = xmalloc(l + 1);
+	/*
+	 * If most significant bit is set then prepend a zero byte to
+	 * avoid interpretation as a negative number.
+	 */
+	if (l > 0 && (s[0] & 0x80) != 0) {
+		*p++ = '\0';
+		pad = 1;
+	}
+	memcpy(p, s, l);
+	buffer_put_string(buffer, buf, l + pad);
+	memset(buf, '\0', l + pad);
+	free(buf);
+}
+
+