search for: pdf_gen_xor

The mac_compute() function in openssh calls umac_final() to prepend a tag to a buffer. Umac_final() calls pdf_gen_xor() on the tag as its final operation, and as implemented, pdf_gen_xor() assumes an appropriate alignment for 64-bit operations on its buffer. However, the buffer is declared in mac_compute() as a static u_char array, and the linker doesn't guarantee 64-bit alignment for such arrays. On ARM v7...

...ssue in UMAC implementation, which can cause crash in ssh binary on sparc. Static variable m is defined in mac.c as an array of chars: 168 static u_char m[EVP_MAX_MD_SIZE]; This array is passed to function umac128_final() in ssh/umac.c, and later cast to 64-bit unsigned integer and accessed in pdf_gen_xor(): 264 *((UINT64 *)buf) ^= ((UINT64 *)pc->cache)[ndx]; AFAIK, there is no assurance, that a static char array will be double-word aligned. And indeed, when compiled using Solaris Studio 12.1 cc, the variable address (0x909ac) is only word-aligned: 58588: 37 00 02 42 sethi %hi(0...

Hi, OpenSSH 5.4 is almost ready for release, so we would appreciate testing on as many platforms and systems as possible. This is a big release, with a number of major new features and many bug fixes. Snapshot releases for portable OpenSSH are available from http://www.mindrot.org/openssh_snap/ The OpenBSD version is available in CVS HEAD: http://www.openbsd.org/anoncvs.html Portable OpenSSH