From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sat, 4 Jul 2026 11:19:49 +0200
Subject: [PATCH] publickey: fix potential OOB read in
 `libssh2_publickey_list_fetch()`

Reported-by: Vladimir Eli Tokarev
Fixes GHSA-w6g9-cpfp-22gc

Closes #2202
---
 src/publickey.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/publickey.c b/src/publickey.c
index 3254ad91e7..ec263c2287 100644
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -929,6 +929,13 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
                 }
 
                 if(comment_len) {
+                    if(pkey->listFetch_s + comment_len >
+                       pkey->listFetch_data + pkey->listFetch_data_len) {
+                        ssh2_err(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+                                 "ListFetch data too short");
+                        goto err_exit;
+                    }
+
                     list[keys].num_attrs = 1;
                     list[keys].attrs =
                         SSH2_ALLOC(session,