upstream: memleak in error path; spotted by oss-fuzz, ok markus@

OpenBSD-Commit-ID: d6ed260cbbc297ab157ad63931802fb1ef7a4266

diff --git a/sshkey-xmss.c b/sshkey-xmss.c
index 9e5f5e47565853dc6dab3df35d00c4a0376f2d61..e8e2e3816e0c8af4a0fe5e4114602639f219d106 100644 (file)
--- a/sshkey-xmss.c
+++ b/sshkey-xmss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey-xmss.c,v 1.6 2019/10/09 00:02:57 djm Exp $ */
+/* $OpenBSD: sshkey-xmss.c,v 1.7 2019/10/14 06:00:02 djm Exp $ */
 /*
  * Copyright (c) 2017 Markus Friedl.  All rights reserved.
  *
@@ -748,7 +748,7 @@ sshkey_xmss_deserialize_state(struct sshkey *k, struct sshbuf *b)
        u_int32_t i, lh, node;
        size_t ls, lsl, la, lk, ln, lr;
        char *magic;
-       int r;
+       int r = SSH_ERR_INTERNAL_ERROR;
 
        if (state == NULL)
                return SSH_ERR_INVALID_ARGUMENT;
@@ -767,9 +767,11 @@ sshkey_xmss_deserialize_state(struct sshkey *k, struct sshbuf *b)
            (r = sshbuf_get_string(b, &state->th_nodes, &ln)) != 0 ||
            (r = sshbuf_get_string(b, &state->retain, &lr)) != 0 ||
            (r = sshbuf_get_u32(b, &lh)) != 0)
-               return r;
-       if (strcmp(magic, SSH_XMSS_K2_MAGIC) != 0)
-               return SSH_ERR_INVALID_ARGUMENT;
+               goto out;
+       if (strcmp(magic, SSH_XMSS_K2_MAGIC) != 0) {
+               r = SSH_ERR_INVALID_ARGUMENT;
+               goto out;
+       }
        /* XXX check stackoffset */
        if (ls != num_stack(state) ||
            lsl != num_stacklevels(state) ||
@@ -777,8 +779,10 @@ sshkey_xmss_deserialize_state(struct sshkey *k, struct sshbuf *b)
            lk != num_keep(state) ||
            ln != num_th_nodes(state) ||
            lr != num_retain(state) ||
-           lh != num_treehash(state))
-               return SSH_ERR_INVALID_ARGUMENT;
+           lh != num_treehash(state)) {
+               r = SSH_ERR_INVALID_ARGUMENT;
+               goto out;
+       }
        for (i = 0; i < num_treehash(state); i++) {
                th = &state->treehash[i];
                if ((r = sshbuf_get_u32(b, &th->h)) != 0 ||
@@ -786,7 +790,7 @@ sshkey_xmss_deserialize_state(struct sshkey *k, struct sshbuf *b)
                    (r = sshbuf_get_u32(b, &th->stackusage)) != 0 ||
                    (r = sshbuf_get_u8(b, &th->completed)) != 0 ||
                    (r = sshbuf_get_u32(b, &node)) != 0)
-                       return r;
+                       goto out;
                if (node < num_th_nodes(state))
                        th->node = &state->th_nodes[node];
        }
@@ -794,7 +798,11 @@ sshkey_xmss_deserialize_state(struct sshkey *k, struct sshbuf *b)
        xmss_set_bds_state(&state->bds, state->stack, state->stackoffset,
            state->stacklevels, state->auth, state->keep, state->treehash,
            state->retain, 0);
-       return 0;
+       /* success */
+       r = 0;
+ out:
+       free(magic);
+       return r;
 }
 
 int