diff options
| author |   djm <djm@openbsd.org> | 2014-06-24 00:52:02 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2014-06-24 00:52:02 +0000 |
| commit | f88ffa87bcfea823dec158b57dbfa7d3cca40ea3 (patch) | |
| tree | 445a1702a96e2a77916e31501164df9423fb34ef | |
| parent | repair ramdisk builds (diff) | |
| download | wireguard-openbsd-f88ffa87bcfea823dec158b57dbfa7d3cca40ea3.tar.xz wireguard-openbsd-f88ffa87bcfea823dec158b57dbfa7d3cca40ea3.zip | |
fix bug in KRL generation: multiple consecutive revoked certificate
serial number ranges could be serialised to an invalid format.
Readers of a broken KRL caused by this bug will fail closed, so no
should-have-been-revoked key will be accepted.
| -rw-r--r-- | usr.bin/ssh/krl.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/usr.bin/ssh/krl.c b/usr.bin/ssh/krl.c index 2e0d474683d..3106ff2ebbc 100644 --- a/usr.bin/ssh/krl.c +++ b/usr.bin/ssh/krl.c @@ -14,7 +14,7 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $OpenBSD: krl.c,v 1.15 2014/04/28 03:09:18 djm Exp $ */ +/* $OpenBSD: krl.c,v 1.16 2014/06/24 00:52:02 djm Exp $ */ #include <sys/types.h> #include <sys/param.h> @@ -573,6 +573,7 @@ revoked_certs_generate(struct revoked_certs *rc, Buffer *buf) buffer_put_char(buf, state); buffer_put_string(buf, buffer_ptr(§), buffer_len(§)); + buffer_clear(§); } /* If we are starting a new section then prepare it now */ |