33 lines
1003 B
Diff
33 lines
1003 B
Diff
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
|
|
index d29a03b4..d7283136 100644
|
|
--- a/ssh-keyscan.c
|
|
+++ b/ssh-keyscan.c
|
|
@@ -490,6 +490,15 @@ congreet(int s)
|
|
return;
|
|
}
|
|
|
|
+ /*
|
|
+ * Read the server banner as per RFC4253 section 4.2. The "SSH-"
|
|
+ * protocol identification string may be preceeded by an arbitarily
|
|
+ * large banner which we must read and ignore. Loop while reading
|
|
+ * newline-terminated lines until we have one starting with "SSH-".
|
|
+ * The ID string cannot be longer than 255 characters although the
|
|
+ * preceeding banner lines may (in which case they'll be discarded
|
|
+ * in multiple iterations of the outer loop).
|
|
+ */
|
|
for (;;) {
|
|
memset(buf, '\0', sizeof(buf));
|
|
bufsiz = sizeof(buf);
|
|
@@ -517,6 +526,11 @@ congreet(int s)
|
|
conrecycle(s);
|
|
return;
|
|
}
|
|
+ if (cp >= buf + sizeof(buf)) {
|
|
+ error("%s: greeting exceeds allowable length", c->c_name);
|
|
+ confree(s);
|
|
+ return;
|
|
+ }
|
|
if (*cp != '\n' && *cp != '\r') {
|
|
error("%s: bad greeting", c->c_name);
|
|
confree(s);
|