merge from main

5 files changed, 17 insertions, 11 deletions

diff --git a/buffer.c b/buffer.c
index 173b8e2..fee41d6 100644
--- a/buffer.c
+++ b/buffer.c
@@ -125,18 +125,23 @@ void buf_incrwritepos(buffer* buf, unsigned int incr) {
 	}
 }
 
-/* increment the position by incr, negative values are allowed, to
- * decrement the pos*/
-void buf_incrpos(buffer* buf,  int incr) {
+/* increment the position by incr */
+void buf_incrpos(buffer* buf, unsigned int incr) {
 	if (incr > BUF_MAX_INCR 
-		|| incr < -BUF_MAX_INCR 
-		|| (unsigned int)((int)buf->pos + incr) > buf->len
-		|| ((int)buf->pos + incr) < 0) {
+		|| (buf->pos + incr) > buf->len) {
 		dropbear_exit("Bad buf_incrpos");
 	}
 	buf->pos += incr;
 }
 
+/* decrement the position by decr */
+void buf_decrpos(buffer* buf, unsigned int decr) {
+	if (decr > buf->pos) {
+		dropbear_exit("Bad buf_decrpos");
+	}
+	buf->pos -= decr;
+}
+
 /* Get a byte from the buffer and increment the pos */
 unsigned char buf_getbyte(buffer* buf) {
 
diff --git a/buffer.h b/buffer.h
index 85f913d..5b55414 100644
--- a/buffer.h
+++ b/buffer.h
@@ -49,7 +49,8 @@ buffer* buf_newcopy(const buffer* buf);
 void buf_setlen(buffer* buf, unsigned int len);
 void buf_incrlen(buffer* buf, unsigned int incr);
 void buf_setpos(buffer* buf, unsigned int pos);
-void buf_incrpos(buffer* buf, int incr); /* -ve is ok, to go backwards */
+void buf_incrpos(buffer* buf, unsigned int incr);
+void buf_decrpos(buffer* buf, unsigned int decr);
 void buf_incrwritepos(buffer* buf, unsigned int incr);
 unsigned char buf_getbyte(buffer* buf);
 unsigned char buf_getbool(buffer* buf);
diff --git a/keyimport.c b/keyimport.c
index 2b80770..e58c52d 100644
--- a/keyimport.c
+++ b/keyimport.c
@@ -637,7 +637,7 @@ static sign_key *openssh_read(const char *filename, const char * UNUSED(passphra
 				buf_incrpos(blobbuf, 8);
 				buf_eatstring(blobbuf);
 				buf_eatstring(blobbuf);
-				buf_incrpos(blobbuf, -SSH_SIGNKEY_ED25519_LEN-4);
+				buf_decrpos(blobbuf, SSH_SIGNKEY_ED25519_LEN+4);
 				if (buf_get_ed25519_priv_key(blobbuf, retkey->ed25519key)
 						== DROPBEAR_SUCCESS) {
 					errmsg = NULL;
diff --git a/signkey.c b/signkey.c
index 92fe6a2..1f9b682 100644
--- a/signkey.c
+++ b/signkey.c
@@ -235,7 +235,7 @@ int buf_get_pub_key(buffer *buf, sign_key *key, enum signkey_type *type) {
 	*type = keytype;
 
 	/* Rewind the buffer back before "ssh-rsa" etc */
-	buf_incrpos(buf, -len - 4);
+	buf_decrpos(buf, len + 4);
 
 #if DROPBEAR_DSS
 	if (keytype == DROPBEAR_SIGNKEY_DSS) {
@@ -316,7 +316,7 @@ int buf_get_priv_key(buffer *buf, sign_key *key, enum signkey_type *type) {
 	*type = keytype;
 
 	/* Rewind the buffer back before "ssh-rsa" etc */
-	buf_incrpos(buf, -len - 4);
+	buf_decrpos(buf, len + 4);
 
 #if DROPBEAR_DSS
 	if (keytype == DROPBEAR_SIGNKEY_DSS) {
diff --git a/svr-authpubkey.c b/svr-authpubkey.c
index 46237b7..a33cc39 100644
--- a/svr-authpubkey.c
+++ b/svr-authpubkey.c
@@ -294,7 +294,7 @@ static int checkpubkey_line(buffer* line, int line_num, const char* filename,
 				is_comment = 1;
 				break;
 			}
-			buf_incrpos(line, -1);
+			buf_decrpos(line, 1);
 			break;
 		}
 		if (is_comment) {