gru/mikrotik-backup
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Mateusz Gruszczyński committed 2026-10-28 09:16:54 +01:00
commit 32a7ba8e8f
168 files changed
+123856
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

vendor/libssh2-sys/patches/upstream/58050-34497525929b.patch
Vendored
+35
View File
@@ -0,0 +1,35 @@
From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sun, 28 Jun 2026 02:12:52 +0200
Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
`libssh2_publickey_list_fetch()`
Cap list size at 1024 elements.
Reported-and-initial-patch-by: Mateusz Gierblinski
Reported-and-initial-patch-by: Behzod Abdullayev
Reported-by: Sharique Raza
Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
Closes #2128
---
src/publickey.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/publickey.c b/src/publickey.c
index a0d3100005..3a6dd116d2 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -1048,6 +1048,11 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
}
if(list[keys].num_attrs) {
+ if(list[keys].num_attrs > 1024) {
+ ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
+ "Too many publickey attributes");
+ goto err_exit;
+ }
list[keys].attrs =
SSH2_ALLOC(session,
list[keys].num_attrs *
vendor/libssh2-sys/patches/upstream/58051-a9758da45a52.patch
Vendored
+28
View File
@@ -0,0 +1,28 @@
From a9758da45a52bc8c630ec9493804d0c6ea30b24a Mon Sep 17 00:00:00 2001
From: Viktor Szakats <vszakats@users.noreply.github.com>
Date: Mon, 29 Jun 2026 19:12:21 +0200
Subject: [PATCH] publickey: fix potential arbitrary free in
`libssh2_publickey_list_fetch()` (#2127)
Due to uninitialized list entry.
Reported-and-patch-by: Behzod Abdullayev
Reported-by: Sharique Raza
Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
---
src/publickey.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/publickey.c b/src/publickey.c
index b7f384310e..a0d3100005 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -905,6 +905,7 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
goto err_exit;
}
list = newlist;
+ memset(&list[keys], 0, sizeof(list[keys]));
}
if(pkey->version == 1) {
unsigned long comment_len;
vendor/libssh2-sys/patches/upstream/66032-5e4776146552.patch
Vendored
+25
View File
@@ -0,0 +1,25 @@
From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Thu, 2 Jul 2026 11:00:23 -0700
Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
Set data to NULL after freeing it to avoid dangling pointer. fixes
GHSA-px3w-7g75-hg7w.
Credit: VladimirEliTokarev
---
src/sftp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/sftp.c b/src/sftp.c
index ec3a8ae18a..842eb6ea51 100644
--- a/src/sftp.c
+++ b/src/sftp.c
@@ -1259,6 +1259,7 @@ static LIBSSH2_SFTP_HANDLE *sftp_open(LIBSSH2_SFTP *sftp,
ssh2_deb((session, LIBSSH2_TRACE_SFTP, "got HANDLE FXOK"));
SSH2_FREE(session, data);
+ data = NULL;
/* silly situation, but check for a HANDLE */
rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,
vendor/libssh2-sys/patches/upstream/66033-a2ed82d40964.patch
Vendored
+41
View File
@@ -0,0 +1,41 @@
From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Thu, 23 Jul 2026 10:32:04 +0200
Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in
`ssh2_cipher_crypt()`
By applying two bounds checks to non-debug builds.
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-c4f7-cvfc-33j7
Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
Closes #2401
---
src/openssl.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/src/openssl.c b/src/openssl.c
index 6a38b55b91..31ef6db371 100644
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -945,13 +945,15 @@ int ssh2_cipher_crypt(ssh2_cipher_ctx *ctx, SSH2_CIPHER_T(algo), int encrypt,
const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
/* size of AT, if present */
const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
- /* length to encrypt */
- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+ unsigned int cryptlen; /* length to encrypt */
(void)algo;
- assert(blocksize <= sizeof(buf));
- assert(cryptlen >= 0);
+ if(blocksize > sizeof(buf) ||
+ blocksize < (size_t)(aadlen + authenticationtag))
+ return 1;
+
+ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
#if LIBSSH2_AES_GCM
/* First block */
vendor/libssh2-sys/patches/upstream/66034-a13bb6c773f0.patch
Vendored
+32
View File
@@ -0,0 +1,32 @@
From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sat, 4 Jul 2026 11:19:49 +0200
Subject: [PATCH] publickey: fix potential OOB read in
`libssh2_publickey_list_fetch()`
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-w6g9-cpfp-22gc
Closes #2202
---
src/publickey.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/publickey.c b/src/publickey.c
index 3254ad91e7..ec263c2287 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -929,6 +929,13 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
}
if(comment_len) {
+ if(pkey->listFetch_s + comment_len >
+ pkey->listFetch_data + pkey->listFetch_data_len) {
+ ssh2_err(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+ "ListFetch data too short");
+ goto err_exit;
+ }
+
list[keys].num_attrs = 1;
list[keys].attrs =
SSH2_ALLOC(session,
vendor/libssh2-sys/patches/upstream/66035-42e33d81577e.patch
Vendored
+38
View File
@@ -0,0 +1,38 @@
From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 3 Jul 2026 18:22:55 +0200
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-6c79-444r-wx26
Closes #2198
---
src/transport.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/transport.c b/src/transport.c
index 6f05a0fdd4..94c66745c2 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -237,6 +237,12 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
unsigned char *decrypt_buffer;
int blocksize = session->remote.crypt->blocksize;
+ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+ SSH2_SAFEFREE(session, p->payload);
+ return LIBSSH2_ERROR_DECRYPT;
+ }
+ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
first_block[0] = 0;
rc = transport_decrypt(session, p->payload + 4,
@@ -245,7 +251,6 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
return rc;
/* we need buffer for decrypt */
- decrypt_size = p->total_num - mac_len - 4;
decrypt_buffer = SSH2_ALLOC(session, decrypt_size);
if(!decrypt_buffer)
return LIBSSH2_ERROR_ALLOC;
vendor/libssh2-sys/patches/upstream/7598-256d04b60d80.patch
Vendored
+52
View File
@@ -0,0 +1,52 @@
From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Mon, 13 Apr 2026 11:18:25 -0700
Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
Return errors when username_len will exceed bounds, fix existing bounds
check.
Credit:
[dapickle](https://github.com/dapickle)
---
src/userauth.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/userauth.c b/src/userauth.c
index f8e02651c4..43d9ab9b9d 100644
--- a/src/userauth.c
+++ b/src/userauth.c
@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
memset(&session->userauth_list_packet_requirev_state, 0,
sizeof(session->userauth_list_packet_requirev_state));
+ if(username_len > UINT32_MAX - 27) {
+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+ "username_len out of bounds");
+ return NULL;
+ }
+
session->userauth_list_data_len = username_len + 27;
if(session->userauth_list_data) {
@@ -316,6 +322,11 @@ userauth_password(LIBSSH2_SESSION *session,
* 40 = packet_type(1) + username_len(4) + service_len(4) +
* service(14)"ssh-connection" + method_len(4) + method(8)"password" +
* chgpwdbool(1) + password_len(4) */
+ if(username_len > UINT32_MAX - 40) {
+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+ "username_len out of bounds");
+ }
+
session->userauth_pswd_data_len = username_len + 40;
session->userauth_pswd_data0 =
@@ -456,7 +467,7 @@ userauth_password(LIBSSH2_SESSION *session,
}
/* basic data_len + newpw_len(4) */
- if(username_len + password_len + 44 <= UINT_MAX) {
+ if(username_len <= UINT32_MAX - password_len - 44) {
session->userauth_pswd_data_len =
username_len + password_len + 44;
s = session->userauth_pswd_data =
vendor/libssh2-sys/patches/upstream/publickey-leak-c2f1a3a21b4c.patch
Vendored
+61
View File
@@ -0,0 +1,61 @@
From c2f1a3a21b4c922cbcf50bf7c009b740141a1e7a Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 21 Jul 2026 17:51:42 +0200
Subject: [PATCH] publickey: fix `attr` memleak on error in
`libssh2_publickey_list_fetch()`
In case of error, the last touched list entry could have the `attr`
field assigned to an allocated buffer, while still having NULL `packet`.
This made the destructore skip this entry and leak `attr`.
Fix by initializing all new list entries to zero and freeing entries
with either `attr` or `packet` set, up to entry where both are NULL.
Reported-by: hyunjiHong on github
Fixes #2368
Closes #2380
---
src/publickey.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/publickey.c b/src/publickey.c
index 43b8123e62..7db71a4249 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -941,7 +941,7 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
goto err_exit;
}
list = newlist;
- memset(&list[keys], 0, sizeof(list[keys]));
+ memset(&list[keys], 0, (max_keys - keys) * sizeof(list[keys]));
}
if(pkey->version == 1) {
unsigned long comment_len;
@@ -1180,10 +1180,9 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
}
/* To be FREEd in libssh2_publickey_list_free() */
list[keys].packet = pkey->listFetch_data;
- keys++;
-
- list[keys].packet = NULL; /* Terminate the list */
pkey->listFetch_data = NULL;
+
+ keys++;
break;
default:
/* Unknown/Unexpected */
@@ -1217,10 +1216,11 @@ void libssh2_publickey_list_free(LIBSSH2_PUBLICKEY *pkey,
session = pkey->channel->session;
- while(p->packet) {
+ while(p->attrs || p->packet) {
if(p->attrs)
SSH2_FREE(session, p->attrs);
- SSH2_FREE(session, p->packet);
+ if(p->packet)
+ SSH2_FREE(session, p->packet);
p++;
}
vendor/libssh2-sys/patches/upstream/publickey-terminator-ad16eb112f4a.patch
Vendored
+32
View File
@@ -0,0 +1,32 @@
From ad16eb112f4a9591acdf5f6f2981328613e6b626 Mon Sep 17 00:00:00 2001
From: "RELAUNCH DEPT." <215028820+ceodaradigu@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:51:41 +0200
Subject: [PATCH] publickey: initialize the list terminator
The allocation reserves `max_keys + 1` entries, while the initialization
after growth currently covers only `max_keys - keys` entries. Include
the additional reserved entry in that initialization so the list
terminator is initialized at exact capacity boundaries.
Follow-up to c2f1a3a21b4c922cbcf50bf7c009b740141a1e7a #2380
Ref: https://github.com/libssh2/libssh2/pull/2380#pullrequestreview-4746725158
Closes #2579
---
src/publickey.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/publickey.c b/src/publickey.c
index d49ec48d38..36a60c141a 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -941,7 +941,8 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
goto err_exit;
}
list = newlist;
- memset(&list[keys], 0, (max_keys - keys) * sizeof(list[keys]));
+ memset(&list[keys], 0,
+ (max_keys - keys + 1) * sizeof(list[keys]));
}
if(pkey->version == 1) {
unsigned long comment_len;