36 lines
1.2 KiB
Diff
36 lines
1.2 KiB
Diff
From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
|
|
From: Viktor Szakats <commit@vsz.me>
|
|
Date: Sun, 28 Jun 2026 02:12:52 +0200
|
|
Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
|
|
`libssh2_publickey_list_fetch()`
|
|
|
|
Cap list size at 1024 elements.
|
|
|
|
Reported-and-initial-patch-by: Mateusz Gierblinski
|
|
Reported-and-initial-patch-by: Behzod Abdullayev
|
|
Reported-by: Sharique Raza
|
|
|
|
Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
|
|
|
|
Closes #2128
|
|
---
|
|
src/publickey.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/src/publickey.c b/src/publickey.c
|
|
index a0d3100005..3a6dd116d2 100644
|
|
--- a/src/publickey.c
|
|
+++ b/src/publickey.c
|
|
@@ -1048,6 +1048,11 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey,
|
|
}
|
|
|
|
if(list[keys].num_attrs) {
|
|
+ if(list[keys].num_attrs > 1024) {
|
|
+ ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
|
|
+ "Too many publickey attributes");
|
|
+ goto err_exit;
|
|
+ }
|
|
list[keys].attrs =
|
|
SSH2_ALLOC(session,
|
|
list[keys].num_attrs *
|