first commit

vendor/libssh2-sys/patches/upstream/58050-34497525929b.patch

@@ -0,0 +1,35 @@
+From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sun, 28 Jun 2026 02:12:52 +0200
+Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
+ `libssh2_publickey_list_fetch()`
+
+Cap list size at 1024 elements.
+
+Reported-and-initial-patch-by: Mateusz Gierblinski
+Reported-and-initial-patch-by: Behzod Abdullayev
+Reported-by: Sharique Raza
+
+Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
+
+Closes #2128
+---
+ src/publickey.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/publickey.c b/src/publickey.c
+index a0d3100005..3a6dd116d2 100644
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -1048,6 +1048,11 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
+                 }
+ 
+                 if(list[keys].num_attrs) {
++                    if(list[keys].num_attrs > 1024) {
++                        ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
++                                 "Too many publickey attributes");
++                        goto err_exit;
++                    }
+                     list[keys].attrs =
+                         SSH2_ALLOC(session,
+                                    list[keys].num_attrs *