openssh bugs - Jun 2012 - [Bug 2022] ssh segfaults when using ldns, SSHFP, a DNSSEC-enabled resolver and a CNAME

https://bugzilla.mindrot.org/show_bug.cgi?id=2022

--- Comment #2 from Darren Tucker <dtucker at zip.com.au> ---
Patch applied, thanks.

I still don't understand how it gets into this state since the space
should be allocated immediately beforehand:

        if (rrset->rri_nsigs > 0) {
                rrset->rri_sigs = calloc(rrset->rri_nsigs,
                    sizeof(struct rdatainfo));

What's rrset->rri_nsigs in the failure case?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2022

--- Comment #3 from gregdlg+mr at hochet.info ---
The failure case happens when your DNS resolver does the DNSSEC
validation for you and sets the ad flag (but RRSIG are still included
DNS answer). Then SSH trusts the resolver, skip the DNSSEC validation
and does not initialize rrset->rri_nsig, hence rrset->rri_nsig is 0 and
the memory is not allocated.

    /* Check for authenticated data */
    if (ldns_pkt_ad(pkt)) {
        rrset->rri_flags |= RRSET_VALIDATED;
    } else { /* AD is not set, try autonomous validation */
        //...
        rrset->rri_nsigs = ldns_rr_list_rr_count(rrsigs);
        debug2("ldns: got %u signature(s) (RRTYPE %u) from DNS",
               rrset->rri_nsigs, LDNS_RR_TYPE_RRSIG);
        //...
    }

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2022

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Darren Tucker <dtucker at zip.com.au> ---
OK, makes sense.  Thanks, the patch will be in the next release.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.