IV is always valid in this case.
however, we removed this code for the next release, since it's not used.
On Mon, May 15, 2006 at 03:18:58PM -0500, Kylene Jo Hall
wrote:> The variable IV does can be NULL when passed into the function. However,
> IV is dereferenced in CMP, therefore, IV should be checked before
> sending it to this macro. This patch adds what is common in other parts
> of the code but is missing on this particular check. This entire set of
> patches passed the regression tests on my system. Null dereference bug
> found by Coverity.
>
> Signed-off-by: Kylene Hall <kjhall at us.ibm.com>
> ---
> deattack.c | 2 +-
> 1 files changed, 1 insertion(+), 1 deletion(-)
>
> diff -uprN openssh-4.3p2/deattack.c openssh-4.3p2-kylie/deattack.c
> --- openssh-4.3p2/deattack.c 2003-09-22 06:04:23.000000000 -0500
> +++ openssh-4.3p2-kylie/deattack.c 2006-05-04 15:10:19.000000000 -0500
> @@ -137,7 +137,7 @@ detect_attack(u_char *buf, u_int32_t len
> for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
> i = (i + 1) & (n - 1)) {
> if (h[i] == HASH_IV) {
> - if (!CMP(c, IV)) {
> + if (IV && !CMP(c, IV)) {
> if (check_crc(c, buf, len, IV))
> return (DEATTACK_DETECTED);
> else
>
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev