shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-04 12:20:42 +09:00
Code Issues Packages Projects Releases Wiki Activity

sftp: Fix a possible integer overflow.

Browse Source 
CID: #1238630

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Aris Adamantiadis <aris@0xbadc0de.be>
(cherry picked from commit af0dd3fb02)
This commit is contained in:
Andreas Schneider
2015-01-14 11:16:59 +01:00
parent fd3b1f63a1
commit 4de6a708ad
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/sftp.c
View File

@@ -340,7 +340,6 @@ sftp_packet sftp_packet_read(sftp_session sftp) {
return NULL;
}
size = ntohl(size);
r=ssh_channel_read(sftp->channel, buffer, 1, 0);
if (r <= 0) {
/* TODO: check if there are cases where an error needs to be set here */
@@ -350,7 +349,12 @@ sftp_packet sftp_packet_read(sftp_session sftp) {
}
buffer_add_data(packet->payload, buffer, r);
buffer_get_u8(packet->payload, &packet->type);
size=size-1;
size = ntohl(size);
if (size == 0) {
return packet;
}
size--;
while (size>0){
r=ssh_channel_read(sftp->channel,buffer,
sizeof(buffer)>size ? size:sizeof(buffer),0);