upstream: fix hard-to-reach NULL deref during pubkey auth

To hit this, the user must be using a PEM style private key with no corresponding .pub key adjacent to it. OpenBSD-Commit-ID: b7150acc5322fa33f21491834d9471fbe3d30f20
Re-enable SHA1 sigs in OpenSSL on Cygwin for tests.
2026-05-13 15:12:38 +10:00 · 2026-04-29 10:00:12 +10:00 · 2026-04-29 09:18:19 +10:00 · 2026-04-15 08:15:53 +10:00
4 changed files with 20 additions and 16 deletions
@@ -1,16 +1,16 @@
 -----BEGIN PGP SIGNATURE-----

-iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmYHnZ8ACgkQKj9BTnNg
-YLquuQ/6A8E6P2jcgn3wmbbCTXP7kmxoh3nmw/e6PC8CEua1512oT3GHOKVD5cGK
-cgYRObpWvjOjg7L1HRABftq7a9M2zfsGnY/WNe3/fbetfkyY8hG8c31vA1ePIOt2
-AjBLCWFblH0CtyH/MssoQ19JCLtXK/GmekB1Q0JzyOog7w/0r3CKuUnZ0juCYR1R
-4FBePl5l3nFSZEcFEdptGlNGeuolS5XBCqB9Y91TCzkVkH5eXUUW+shgjNhWCEhT
-pZvkxfhsmOEnwNofyPdgKVfDBVkHmvuC67EU395mJVN4c2NZ8pOztb9hOt3xr980
-q44I4kT2NpaApCx1dWIGhMy/37LJ8heI0W1B+ofTA5n34/RU8UXH3SCkj2AK6Ao5
-H2u8vbmuWKUCiECmrw35EeKGmtuK/bWJzx3KBP7fx5J9S3mWUgT4W4xlWNN9RWoU
-sSvH1ppie5ARINVaAWl5k44fk60ahTf80DbQBIOZBmQn7myZZka+yGcQbAiZZ1Gc
-0l8+Nf5Ao1ckmuyY5o8FyWdsyDeK3+MqjPn5Rr1CqbKCn2VnqrVWbI33Eyu8c96U
-bxVgU5H1BDhNjJC8UrT3LFPvJMO8p3a0IJ3eHydjk2jVOhOdBZmA0yoqUTrhPpXq
-ymIHESjDJR8TDe4TCfb46o9oEC3cdbDwgnzPqdg0n+0uIsJLYiU=
-=gl+l
+iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmnevEAACgkQKj9BTnNg
+YLr72w//ay7JpFSfUF5h97Vi2T58fwkRO2aapXrK8f3mnzeelN9H09XBpRquFZCL
+o5S/8RSmVtRjCTXyo7GjwhaAF6+XyKiKgwvjTnY9EA4leCCoNdBJ2/77xlBZdPD4
+AuKPRQKpGjJi+P+2yB0ocgpT6MWXDlg0xkdLWaiQC4xpADUD9AlebUVHtCPOqXWb
+LgGampMjQu8usg9QX3x0oHpuMUot+wo3dTD2xjgWv03DmPK7wCUiA760GeEGibma
+jv3JT8JZnDtPk4J0PpoJecoJsMhH9Zoy55yi3d4y/SxBUSIBFs2qcw4tO3iixZwD
+mlZVW83KFhIlH6Q8GJtymrYrQ2Gw88wWZ6Oj3glzHCkrxUeO9MIbnTSzXekg6+O7
+qBxQC4xdlNtHFS+GvG3EZzztl8C4Qfmdl35bStQaVhWzygI5+o19yoeYi4lMTYQM
+CAH6ONeDFvm3SwlTJk41O/zXz7mO1vRpsn5QMCHt3KLBZkkMrSKl4C2r9iuq7MeY
+gx3mnPW6/yu1TzGUl5wtzeb6I2R1/zPK3ibhbGQyt4WggCio3D8xmcmhyxKL79fi
+Pb02QXRYplXrkR6Lf2HCRdJoNu3bodqelkeiAtgj0CLHlK355dtmya6txn4Ccoc1
+kH7vdHqPKJSrsMBZ/Qm+0dA9Kq4Qoib2tog9De09u5p8XQUdAY=
+=9i1L
 -----END PGP SIGNATURE-----
@@ -30,6 +30,10 @@ case "$host" in
 	takeown /F regress
 	icacls regress
 	set +x
+	echo Enabling OpenSSL rh-allow-sha1-signatures for unit tests.
+	cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak
+	sed -i -e '/\[ default_modules \]/a alg_section = evp_properties\n[evp_properties]\nrh-allow-sha1-signatures = yes\n' /etc/pki/tls/openssl.cnf
+	diff -u /etc/pki/tls/openssl.cnf.bak /etc/pki/tls/openssl.cnf
 	PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
 	PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel"
 	;;
@@ -63,7 +63,7 @@ jobs:
          - { target: ubuntu-22.04, config: valgrind-2 }
          - { target: ubuntu-22.04, config: valgrind-3 }
          - { target: ubuntu-22.04, config: valgrind-4 }
-          - { target: ubuntu-22.04, config: valgrind-pam-1 }
+          # - { target: ubuntu-22.04, config: valgrind-pam-1 }
          - { target: ubuntu-22.04, config: valgrind-unit }
          - { target: ubuntu-22.04, config: without-openssl }
          - { target: ubuntu-latest, config: gcc-14 }
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.385 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.386 2026/05/13 05:11:02 djm Exp $ */
 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -1277,7 +1277,7 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
 	 * PKCS#11 tokens may not support all signature algorithms,
 	 * so check what we get back.
 	 */
-	if ((id->key->flags & SSHKEY_FLAG_EXT) != 0 &&
+	if (id->key != NULL && (id->key->flags & SSHKEY_FLAG_EXT) != 0 &&
 	    (r = sshkey_check_sigtype(*sigp, *lenp, alg)) != 0) {
 		debug_fr(r, "sshkey_check_sigtype");
 		goto out;
Author	SHA1	Message	Date
[email protected]	f945f1256d	upstream: fix hard-to-reach NULL deref during pubkey auth To hit this, the user must be using a PEM style private key with no corresponding .pub key adjacent to it. OpenBSD-Commit-ID: b7150acc5322fa33f21491834d9471fbe3d30f20	2026-05-13 15:12:38 +10:00
Darren Tucker	c5e2569294	Re-enable SHA1 sigs in OpenSSL on Cygwin for tests. Recently Cygwin imported changes from Fedora which disable SHA1 signatures by default. This breaks the unit tests (and a couple of regression tests), so set rh-allow-sha1-signatures=yes in the OpenSSL config to re-enable them.	2026-04-29 10:00:12 +10:00
Darren Tucker	69c8f8c32b	Comment out new PAM valgrind test until debugged.	2026-04-29 09:18:19 +10:00
Damien Miller	8c9ccea39c	regen signature on allowed_signers file This was missed after the file was updated, but nobody noticed it until now.	2026-04-15 08:15:53 +10:00