first commit

vendor/libssh2-sys/patches/upstream/66035-42e33d81577e.patch

@@ -0,0 +1,38 @@
+From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Fri, 3 Jul 2026 18:22:55 +0200
+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-6c79-444r-wx26
+
+Closes #2198
+---
+ src/transport.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index 6f05a0fdd4..94c66745c2 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -237,6 +237,12 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
+                 unsigned char *decrypt_buffer;
+                 int blocksize = session->remote.crypt->blocksize;
+ 
++                if(p->total_num < mac_len + 4 + (size_t)blocksize) {
++                    SSH2_SAFEFREE(session, p->payload);
++                    return LIBSSH2_ERROR_DECRYPT;
++                }
++                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
++
+                 first_block[0] = 0;
+ 
+                 rc = transport_decrypt(session, p->payload + 4,
+@@ -245,7 +251,6 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
+                     return rc;
+ 
+                 /* we need buffer for decrypt */
+-                decrypt_size = p->total_num - mac_len - 4;
+                 decrypt_buffer = SSH2_ALLOC(session, decrypt_size);
+                 if(!decrypt_buffer)
+                     return LIBSSH2_ERROR_ALLOC;