From 90baf5c65e4a38cf104f096c33e355ffa6b42502 Mon Sep 17 00:00:00 2001 From: djm Date: Fri, 13 Nov 2020 07:30:44 +0000 Subject: scrub keyboard-interactive authentication prompts coming from the server through asmprintf() prior to display; suggested by and ok dtucker@ --- usr.bin/ssh/sshconnect2.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'usr.bin/ssh/sshconnect2.c') diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index 61fe24f33b9..1abd3aac182 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.335 2020/11/13 04:53:12 djm Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.336 2020/11/13 07:30:44 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -32,6 +32,7 @@ #include #include +#include #include #include #include @@ -1917,9 +1918,10 @@ input_userauth_info_req(int type, u_int32_t seq, struct ssh *ssh) if ((r = sshpkt_get_cstring(ssh, &prompt, NULL)) != 0 || (r = sshpkt_get_u8(ssh, &echo)) != 0) goto out; - xasprintf(&display_prompt, "(%s@%s) %s", + if (asmprintf(&display_prompt, INT_MAX, NULL, "(%s@%s) %s", authctxt->server_user, options.host_key_alias ? - options.host_key_alias : authctxt->host, prompt); + options.host_key_alias : authctxt->host, prompt) == -1) + fatal_f("asmprintf failed"); response = read_passphrase(display_prompt, echo ? RP_ECHO : 0); if ((r = sshpkt_put_cstring(ssh, response)) != 0) goto out; -- cgit v1.2.3-59-g8ed1b