upstream: fix client use-after-free on error path if cipher_init()

fails; reported by Qualys Security Advisory Team, ok markus@

OpenBSD-Commit-ID: a8731da0c462b2b9d11314ba505c26ee0cdada83

diff --git a/packet.c b/packet.c
index 8c1d313c2179b1bf0ff7e9faca3060963dfb695b..53a29e338a69212b079a89816b01ead3717b6d85 100644 (file)
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.335 2026/04/13 08:18:33 job Exp $ */
+/* $OpenBSD: packet.c,v 1.336 2026/05/31 04:24:39 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -302,7 +302,7 @@ ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
 {
        struct session_state *state;
        const struct sshcipher *none = cipher_by_name("none");
-       int r;
+       int r, wasnull = ssh == NULL;
 
        if (none == NULL) {
                error_f("cannot load cipher 'none'");
@@ -323,7 +323,8 @@ ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
            (r = cipher_init(&state->receive_context, none,
            (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) {
                error_fr(r, "cipher_init failed");
-               free(ssh); /* XXX need ssh_free_session_state? */
+               if (wasnull)
+                       free(ssh); /* XXX need ssh_free_session_state? */
                return NULL;
        }
        state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL;

diff --git a/ssh.c b/ssh.c
index 531f28eb2a56993a73739657044c99bad25ecded..943e1908eec4e82cc565c459455304d955bcce5f 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.630 2026/04/02 07:50:55 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.631 2026/05/31 04:24:39 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1650,7 +1650,8 @@ main(int ac, char **av)
        if (options.control_path != NULL) {
                int sock;
                if ((sock = muxclient(options.control_path)) >= 0) {
-                       ssh_packet_set_connection(ssh, sock, sock);
+                       if (ssh_packet_set_connection(ssh, sock, sock) == NULL)
+                               fatal("ssh_packet_set_connection failed");
                        ssh_packet_set_mux(ssh);
                        goto skip_connect;
                }