Disallow extra kexinit messages

--HG--
branch : fuzz

1 files changed, 6 insertions, 0 deletions

diff --git a/common-kex.c b/common-kex.c
index 4caa06e..39d916b 100644
--- a/common-kex.c
+++ b/common-kex.c
@@ -487,6 +487,12 @@ void recv_msg_kexinit() {
 		TRACE(("continue recv_msg_kexinit: sent kexinit"))
 	}
 
+	/* "Once a party has sent a SSH_MSG_KEXINIT message ...
+	further SSH_MSG_KEXINIT messages MUST NOT be sent" */
+	if (ses.kexstate.recvkexinit) {
+		dropbear_exit("Unexpected KEXINIT");
+	}
+
 	/* start the kex hash */
 	local_ident_len = strlen(LOCAL_IDENT);
 	remote_ident_len = strlen(ses.remoteident);