X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol_key.c;h=f2f317de5e9888a6d603a95e148bbde371ec139b;hp=1a184fb8f3ba817dccb4553a051361a4bf4b61a9;hb=b403f77dd84b7cae86bdaaf4961af515cf7a3fb9;hpb=4712d8f92e63e86e835ffb624d6399343ee568ea

diff --git a/src/protocol_key.c b/src/protocol_key.c
index 1a184fb8..f2f317de 100644
--- a/src/protocol_key.c
+++ b/src/protocol_key.c
@@ -240,10 +240,16 @@ bool ans_key_h(connection_t *c) {
 		return send_request(to->nexthop->connection, "%s", c->buffer);
 	}
 
+	/* Don't use key material until every check has passed. */
+	from->status.validkey = false;
+
 	/* Update our copy of the origin's packet key */
 	from->outkey = xrealloc(from->outkey, strlen(key) / 2);
 	from->outkeylength = strlen(key) / 2;
-	hex2bin(key, from->outkey, from->outkeylength);
+	if(!hex2bin(key, from->outkey, from->outkeylength)) {
+		logger(LOG_ERR, "Got bad %s from %s(%s): %s", "ANS_KEY", from->name, from->hostname, "invalid key");
+		return true;
+	}
 
 	/* Check and lookup cipher and digest algorithms */