39 lines
1.4 KiB
Diff
39 lines
1.4 KiB
Diff
From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
|
|
From: Viktor Szakats <commit@vsz.me>
|
|
Date: Fri, 3 Jul 2026 18:22:55 +0200
|
|
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
|
|
|
|
Reported-by: Vladimir Eli Tokarev
|
|
Fixes GHSA-6c79-444r-wx26
|
|
|
|
Closes #2198
|
|
---
|
|
src/transport.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/transport.c b/src/transport.c
|
|
index 6f05a0fdd4..94c66745c2 100644
|
|
--- a/src/transport.c
|
|
+++ b/src/transport.c
|
|
@@ -237,6 +237,12 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
|
|
unsigned char *decrypt_buffer;
|
|
int blocksize = session->remote.crypt->blocksize;
|
|
|
|
+ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
|
|
+ SSH2_SAFEFREE(session, p->payload);
|
|
+ return LIBSSH2_ERROR_DECRYPT;
|
|
+ }
|
|
+ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
|
|
+
|
|
first_block[0] = 0;
|
|
|
|
rc = transport_decrypt(session, p->payload + 4,
|
|
@@ -245,7 +251,6 @@ static int transport_fullpacket(LIBSSH2_SESSION *session,
|
|
return rc;
|
|
|
|
/* we need buffer for decrypt */
|
|
- decrypt_size = p->total_num - mac_len - 4;
|
|
decrypt_buffer = SSH2_ALLOC(session, decrypt_size);
|
|
if(!decrypt_buffer)
|
|
return LIBSSH2_ERROR_ALLOC;
|