|
| 1 | +From 7d6da779448c01f323cf73e38a18850660c95d2d Mon Sep 17 00:00:00 2001 |
| 2 | +From: AllSpark < [email protected]> |
| 3 | +Date: Tue, 18 Nov 2025 16:23:38 +0000 |
| 4 | +Subject: [PATCH] ssh/agent: return an error for unexpected message types |
| 5 | + |
| 6 | +Previously, receiving an unexpected message type in response to a key |
| 7 | +listing or a signing request could cause a panic due to a failed type |
| 8 | +assertion. |
| 9 | + |
| 10 | +This change adds a default case to the type switch in order to detect |
| 11 | +and explicitly handle unknown or invalid message types, returning a |
| 12 | +descriptive error instead of crashing. |
| 13 | + |
| 14 | +Fixes golang/go#75178 |
| 15 | + |
| 16 | +Signed-off-by: Azure Linux Security Servicing Account < [email protected]> |
| 17 | +Upstream-reference: AI Backport of https://github.com/golang/crypto/commit/559e062ce8bfd6a39925294620b50906ca2a6f95.patch |
| 18 | +--- |
| 19 | + vendor/golang.org/x/crypto/ssh/agent/client.go | 6 ++++-- |
| 20 | + 1 file changed, 4 insertions(+), 2 deletions(-) |
| 21 | + |
| 22 | +diff --git a/vendor/golang.org/x/crypto/ssh/agent/client.go b/vendor/golang.org/x/crypto/ssh/agent/client.go |
| 23 | +index 106708d..410e21b 100644 |
| 24 | +--- a/vendor/golang.org/x/crypto/ssh/agent/client.go |
| 25 | ++++ b/vendor/golang.org/x/crypto/ssh/agent/client.go |
| 26 | +@@ -430,8 +430,9 @@ func (c *client) List() ([]*Key, error) { |
| 27 | + return keys, nil |
| 28 | + case *failureAgentMsg: |
| 29 | + return nil, errors.New("agent: failed to list keys") |
| 30 | ++ default: |
| 31 | ++ return nil, fmt.Errorf("agent: failed to list keys, unexpected message type %T", msg) |
| 32 | + } |
| 33 | +- panic("unreachable") |
| 34 | + } |
| 35 | + |
| 36 | + // Sign has the agent sign the data using a protocol 2 key as defined |
| 37 | +@@ -462,8 +463,9 @@ func (c *client) SignWithFlags(key ssh.PublicKey, data []byte, flags SignatureFl |
| 38 | + return &sig, nil |
| 39 | + case *failureAgentMsg: |
| 40 | + return nil, errors.New("agent: failed to sign challenge") |
| 41 | ++ default: |
| 42 | ++ return nil, fmt.Errorf("agent: failed to sign challenge, unexpected message type %T", msg) |
| 43 | + } |
| 44 | +- panic("unreachable") |
| 45 | + } |
| 46 | + |
| 47 | + // unmarshal parses an agent message in packet, returning the parsed |
| 48 | +-- |
| 49 | +2.45.4 |
| 50 | + |
0 commit comments