From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sun, 28 Jun 2026 02:12:52 +0200
Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
 `libssh2_publickey_list_fetch()`

Cap list size at 1024 elements.

Reported-and-initial-patch-by: Mateusz Gierblinski
Reported-and-initial-patch-by: Behzod Abdullayev
Reported-by: Sharique Raza

Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9

Closes #2128
---
 src/publickey.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/publickey.c b/src/publickey.c
index a0d3100005..3a6dd116d2 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -1048,6 +1048,11 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
                 }
 
                 if(list[keys].num_attrs) {
+                    if(list[keys].num_attrs > 1024) {
+                        ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
+                                 "Too many publickey attributes");
+                        goto err_exit;
+                    }
                     list[keys].attrs =
                         SSH2_ALLOC(session,
                                    list[keys].num_attrs *