upstream: fix ineffective max file size check when loading

blobs/keys from files and add another one on a patch that was not covered by
the existing ones. From Tess Gauthier via bz3969 and bz3970

OpenBSD-Commit-ID: c0dec6c587853349113df85b6dc528dc15079af0

diff --git a/authfile.c b/authfile.c
index 3f15515c857e03834fc10ee60d3b552aead3abb9..954f78c001b74d1766c827d9faa81c80c2e41574 100644 (file)
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.150 2026/06/14 03:59:34 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.151 2026/06/29 09:14:25 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
@@ -197,6 +197,7 @@ sshkey_try_load_public(struct sshkey **kp, const char *filename,
        char *line = NULL, *cp;
        size_t linesize = 0;
        int r;
+       struct stat st;
        struct sshkey *k = NULL;
 
        if (kp == NULL)
@@ -206,6 +207,11 @@ sshkey_try_load_public(struct sshkey **kp, const char *filename,
                *commentp = NULL;
        if ((f = fopen(filename, "r")) == NULL)
                return SSH_ERR_SYSTEM_ERROR;
+       if (stat(filename, &st) == 0 && S_ISREG(st.st_mode) &&
+           st.st_size > SSHBUF_SIZE_MAX) {
+               fclose(f);
+               return SSH_ERR_INVALID_FORMAT;
+       }
        if ((k = sshkey_new(KEY_UNSPEC)) == NULL) {
                fclose(f);
                return SSH_ERR_ALLOC_FAIL;

diff --git a/sshbuf-io.c b/sshbuf-io.c
index 13ef40e7d272b70b52401d3b699a0ad6970cf5eb..2c1fb4544e2efadf77547a30aebd4100cd8e3e49 100644 (file)
--- a/sshbuf-io.c
+++ b/sshbuf-io.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: sshbuf-io.c,v 1.2 2020/01/25 23:28:06 djm Exp $ */
+/*     $OpenBSD: sshbuf-io.c,v 1.3 2026/06/29 09:14:25 djm Exp $ */
 /*
  * Copyright (c) 2011 Damien Miller
  *
@@ -43,8 +43,7 @@ sshbuf_load_fd(int fd, struct sshbuf **blobp)
 
        if (fstat(fd, &st) == -1)
                return SSH_ERR_SYSTEM_ERROR;
-       if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
-           st.st_size > SSHBUF_SIZE_MAX)
+       if (S_ISREG(st.st_mode) && st.st_size > SSHBUF_SIZE_MAX)
                return SSH_ERR_INVALID_FORMAT;
        if ((blob = sshbuf_new()) == NULL)
                return SSH_ERR_ALLOC_FAIL;
@@ -62,7 +61,7 @@ sshbuf_load_fd(int fd, struct sshbuf **blobp)
                        goto out;
                }
        }
-       if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
+       if (S_ISREG(st.st_mode) == 0 &&
            st.st_size != (off_t)sshbuf_len(blob)) {
                r = SSH_ERR_FILE_CHANGED;
                goto out;