shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-11 18:50:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2026-0968: sftp: Sanitize input handling in sftp_parse_longname()

Browse Source 
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 20856f44c1)
This commit is contained in:
Jakub Jelen
2025-12-22 20:59:11 +01:00
parent 4c0c4ea32e
commit 796d85f786
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/sftp_common.c
View File

@@ -461,16 +461,21 @@ static char * sftp_parse_longname(const char *longname,
const char *p = NULL, *q = NULL;
size_t len, field = 0;
if (longname == NULL || longname_field < SFTP_LONGNAME_PERM ||
longname_field > SFTP_LONGNAME_NAME) {
return NULL;
}
p = longname;
/*
* Find the beginning of the field which is specified
* by sftp_longname_field_e.
*/
while (field != longname_field) {
while (*p != '\0' && field != longname_field) {
if (isspace(*p)) {
field++;
p++;
while (*p && isspace(*p)) {
while (*p != '\0' && isspace(*p)) {
p++;
}
} else {
@@ -478,8 +483,13 @@ static char * sftp_parse_longname(const char *longname,
}
}
/* If we reached NULL before we got our field fail */
if (field != longname_field) {
return NULL;
}
q = p;
while (! isspace(*q)) {
while (*q != '\0' && !isspace(*q)) {
q++;
}