summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2014-07-02 12:48:30 +1000
committerDamien Miller <djm@mindrot.org>2014-07-02 12:48:30 +1000
commit2cd7929250cf9e9f658d70dcd452f529ba08c942 (patch)
tree5e3e72d4ec41cb05af0d8d39799e6c0c8ccb3a78
parent99db840ee8dbbd2b3fbc6c45d0ee2f6a65e96898 (diff)
- djm@cvs.openbsd.org 2014/06/24 00:52:02
[krl.c] fix bug in KRL generation: multiple consecutive revoked certificate serial number ranges could be serialised to an invalid format. Readers of a broken KRL caused by this bug will fail closed, so no should-have-been-revoked key will be accepted.
-rw-r--r--ChangeLog7
-rw-r--r--krl.c3
2 files changed, 9 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index c7f73af1..8f24fc6b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,13 @@
the corresponding ssh_put_bignum functions create. This fixes the
use of 16384-bit RSA keys (bug reported by Eivind Evensen).
ok djm@
+ - djm@cvs.openbsd.org 2014/06/24 00:52:02
+ [krl.c]
+ fix bug in KRL generation: multiple consecutive revoked certificate
+ serial number ranges could be serialised to an invalid format.
+
+ Readers of a broken KRL caused by this bug will fail closed, so no
+ should-have-been-revoked key will be accepted.
20140618
- (tim) [openssh/session.c] Work around to get chroot sftp working on UnixWare
diff --git a/krl.c b/krl.c
index c7aa57e6..557a48eb 100644
--- a/krl.c
+++ b/krl.c
@@ -14,7 +14,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $OpenBSD: krl.c,v 1.15 2014/04/28 03:09:18 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.16 2014/06/24 00:52:02 djm Exp $ */
#include "includes.h"
@@ -575,6 +575,7 @@ revoked_certs_generate(struct revoked_certs *rc, Buffer *buf)
buffer_put_char(buf, state);
buffer_put_string(buf,
buffer_ptr(&sect), buffer_len(&sect));
+ buffer_clear(&sect);
}
/* If we are starting a new section then prepare it now */