File openssh-bsc1161684-authorizedkeyscommand-deadlock.patch of Package openssh.29886

From 3694053e986be0a0dc0871dd9d68a1be2505f691 Mon Sep 17 00:00:00 2001
From: Hans Petter Jansson <hpj@suse.com>
Date: Wed, 26 Oct 2022 10:02:14 +0200
Subject: [PATCH] openssh-bsc1161684-authorizedkeyscommand-deadlock

---
 auth2-pubkey.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 5fb594c2..ee1101d5 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -579,9 +579,12 @@ process_principals(FILE *f, char *file, struct passwd *pw,
 {
 	char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts;
 	u_long linenum = 0;
-	u_int i;
+	u_int i, found_principal = 0;
 
 	while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+		/* Always consume entire input */
+		if (found_principal)
+			continue;
 		/* Skip leading whitespace. */
 		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
 			;
@@ -614,11 +617,12 @@ process_principals(FILE *f, char *file, struct passwd *pw,
 				if (auth_parse_options(pw, line_opts,
 				    file, linenum) != 1)
 					continue;
-				return 1;
+				found_principal = 1;
+				continue;
 			}
 		}
 	}
-	return 0;
+	return found_principal;
 }
 
 static int
@@ -711,6 +715,9 @@ match_principals_command(struct passwd *user_pw, struct sshkey_cert *cert)
 
 	ok = process_principals(f, NULL, pw, cert);
 
+	fclose(f);
+	f = NULL;
+
 	if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command) != 0)
 		goto out;
 
@@ -748,6 +755,11 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 	found = NULL;
 	while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
 		char *cp, *key_options = NULL;
+
+		/* Always consume entire file */
+		if (found_key)
+			continue;
+
 		if (found != NULL)
 			key_free(found);
 		found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
@@ -836,7 +848,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 			    file, linenum, key_type(found), fp);
 			free(fp);
 			found_key = 1;
-			break;
+			continue;
 		}
 	}
 	if (found != NULL)
@@ -1032,6 +1044,9 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
 
 	ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
 
+	fclose(f);
+	f = NULL;
+
 	if (exited_cleanly(pid, "AuthorizedKeysCommand", command) != 0)
 		goto out;
 
-- 
2.38.0