shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-06-11 12:56:21 +09:00
Code Issues Packages Projects Releases Wiki Activity

packet: Avoid hidden integer underflow

Browse Source 
Originally reported by Brian Carpenter b@deepforkcyber.com

Based on the never complted MR !724

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
Merge-Request: <https://gitlab.com/libssh/libssh-mirror/-/merge_requests/819>
This commit is contained in:
Jakub Jelen
2026-04-22 16:57:02 +02:00
parent b2065f71c9
commit 49ad84283e
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/packet.c
View File

@@ -1402,6 +1402,15 @@ ssh_packet_socket_callback(const void *data, size_t receivedlen, void *user)
processed = to_be_read - current_macsize;
}
if (packet_offset - sizeof(uint32_t) > (size_t)packet_len) {
ssh_set_error(session,
SSH_FATAL,
"Invalid packet length %" PRIu32 ", required %zu",
packet_len,
packet_offset + sizeof(uint32_t));
goto error;
}
/* remaining encrypted bytes from the packet, MAC not included */
packet_remaining = packet_len - (packet_offset - sizeof(uint32_t));
cleartext_packet = ssh_buffer_allocate(session->in_buffer,