From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Fri, 3 Jul 2026 18:22:55 +0200 Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt Reported-by: Vladimir Eli Tokarev Fixes GHSA-6c79-444r-wx26 Closes #2198 --- src/transport.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/transport.c b/src/transport.c index 6f05a0fdd4..94c66745c2 100644 --- a/src/transport.c +++ b/src/transport.c @@ -237,6 +237,12 @@ static int transport_fullpacket(LIBSSH2_SESSION *session, unsigned char *decrypt_buffer; int blocksize = session->remote.crypt->blocksize; + if(p->total_num < mac_len + 4 + (size_t)blocksize) { + SSH2_SAFEFREE(session, p->payload); + return LIBSSH2_ERROR_DECRYPT; + } + decrypt_size = (ssize_t)(p->total_num - mac_len - 4); + first_block[0] = 0; rc = transport_decrypt(session, p->payload + 4, @@ -245,7 +251,6 @@ static int transport_fullpacket(LIBSSH2_SESSION *session, return rc; /* we need buffer for decrypt */ - decrypt_size = p->total_num - mac_len - 4; decrypt_buffer = SSH2_ALLOC(session, decrypt_size); if(!decrypt_buffer) return LIBSSH2_ERROR_ALLOC;