hierynomus / hierynomus/sshj

AIOOBE in OpenSSHKeyFile.initPubKey

Open
#411 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.7k
Forks
620
Avg merge
3d 23h
Merged PRs (30d)
11

Description

We've got a few bug-reports from a user who obviously tried to use an unsupported private key file and hence got following exception (our application runs without assertions enabled):

```
java.lang.ArrayIndexOutOfBoundsException
at net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile.initPubKey(OpenSSHKeyFile.java:97)
at net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile.init(OpenSSHKeyFile.java:67)
at net.schmizz.sshj.userauth.keyprovider.BaseFileKeyProvider.init(BaseFileKeyProvider.java:55)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:569)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:538)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:587)

```
The code reads:
```
private void initPubKey(Reader publicKey) {
try {
final BufferedReader br = new BufferedReader(publicKey);
try {
final String keydata = br.readLine();
if (keydata != null) {
String[] parts = keydata.trim().split(" ");
assert parts.length >= 2;
type = KeyType.fromString(parts[0]);
pubKey = new Buffer.PlainBuffer(Base64.decode(parts[1])).readPublicKey(); // << here AIOOBE
}
} finally {
br.close();
}
} catch (IOException e) {
// let super provide both public & private key
log.warn("Error reading public key: {}", e.toString());
}
}
```
IMHO the method needs to handle invalid user data in a different way than indicating a bug.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.