From 4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06 Mon Sep 17 00:00:00 2001
From: Ian Haken <ihaken@netflix.com>
Date: Tue, 23 Oct 2018 16:52:47 +0000
Subject: [PATCH] ssh/agent: Fix error returned from agent responses that are
 too big.

Make sure a meaningful error is returned when the SSH agent client receives
a response that is too big.

Change-Id: Ied68b2c559a61dede2f3112c4c8143babd385f48
GitHub-Last-Rev: ad65e1b423bb00f2501dfde84040469aef4ee2df
GitHub-Pull-Request: golang/crypto#61
Reviewed-on: https://go-review.googlesource.com/c/143058
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
---
 ssh/agent/client.go      |  2 +-
 ssh/agent/client_test.go | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/ssh/agent/client.go b/ssh/agent/client.go
index 1934950..51f7405 100644
--- a/ssh/agent/client.go
+++ b/ssh/agent/client.go
@@ -348,7 +348,7 @@ func (c *client) callRaw(req []byte) (reply []byte, err error) {
 	}
 	respSize := binary.BigEndian.Uint32(respSizeBuf[:])
 	if respSize > maxAgentResponseBytes {
-		return nil, clientErr(err)
+		return nil, clientErr(errors.New("response too large"))
 	}
 
 	buf := make([]byte, respSize)
diff --git a/ssh/agent/client_test.go b/ssh/agent/client_test.go
index e8cd978..2f798f9 100644
--- a/ssh/agent/client_test.go
+++ b/ssh/agent/client_test.go
@@ -241,6 +241,35 @@ func netPipe() (net.Conn, net.Conn, error) {
 	return c1, c2, nil
 }
 
+func TestServerResponseTooLarge(t *testing.T) {
+	a, b, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+
+	defer a.Close()
+	defer b.Close()
+
+	var response identitiesAnswerAgentMsg
+	response.NumKeys = 1
+	response.Keys = make([]byte, maxAgentResponseBytes+1)
+
+	agent := NewClient(a)
+	go func() {
+		n, _ := b.Write(ssh.Marshal(response))
+		if n < 4 {
+			t.Fatalf("At least 4 bytes (the response size) should have been successfully written: %d < 4", n)
+		}
+	}()
+	_, err = agent.List()
+	if err == nil {
+		t.Fatal("Did not get error result")
+	}
+	if err.Error() != "agent: client error: response too large" {
+		t.Fatal("Did not get expected error result")
+	}
+}
+
 func TestAuth(t *testing.T) {
 	agent, _, cleanup := startOpenSSHAgent(t)
 	defer cleanup()