Fix GSS C25519 server blob bounds check

The GSS Curve25519 client path checked
sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] when rejecting public
keys with the high bit set. That indexes one byte past the end of the
sshbuf payload.

The byte after Q_S is the first byte of the following MIC string length,
encoded in network byte order. With OpenSSH's packet size limit this
byte is normally zero, so the bug usually made the intended high-bit
rejection a no-op rather than causing random failures.

A peer can send a high-bit-set Q_S, but it still has to produce the
GSS MIC over the exchange hash for the exact values used. This does
not appear to provide key compromise or authentication bypass; it is a
correctness fix for the validation policy carried by the GSS KEX patch.

Reject an empty server blob explicitly, then test the last payload byte at
sshbuf_len(server_blob) - 1 before passing the blob to kex_c25519_dec().

Author: elric1

kexgssc.c

@@ -246,7 +246,8 @@ kexgss_client(struct ssh *ssh)
 		r = kex_dh_dec(kex, server_blob, &shared_secret);
 		break;
 	case KEX_GSS_C25519_SHA256:
-		if (sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] & 0x80)
+		if (sshbuf_len(server_blob) &&
+		    (sshbuf_ptr(server_blob)[sshbuf_len(server_blob) - 1] & 0x80))
 			fatal("The received key has MSB of last octet set!");
 		r = kex_c25519_dec(kex, server_blob, &shared_secret);
 		break;