6d74aa6138
The specially crafted patterns (from configuration files) could cause exhaustive search or timeouts. Previous attempts to fix this by limiting recursion to depth 16 avoided stack overflow, but not timeouts. This is due to the backtracking, which caused the exponential time complexity O(N^16) of existing algorithm. This is code comes from the same function from OpenSSH, where this code originates from, which is not having this issue (due to not limiting the number of recursion), but will also easily exhaust stack due to unbound recursion:05bcd0cadfThis is an attempt to simplify the algorithm by preventing the backtracking to previous wildcard, which should keep the same behavior for existing inputs while reducing the complexity to linear O(N*M). This fixes the long-term issue we had with fuzzing as well as recently reported security issue by Kang Yang. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Pavol Žáčik <pzacik@redhat.com> (cherry picked from commita411de5ce8)
_ _ _ _
(_) (_) (_) (_)
(_) _ (_) _ _ _ _ _ (_) _
(_) (_) (_)(_) _ (_)(_) (_)(_) (_)(_) _
(_) (_) (_) (_) _ (_) _ (_) (_) (_)
(_) (_) (_)(_)(_) (_)(_) (_)(_) (_) (_).org
The SSH library
Why?
Why not ? :) I've began to work on my own implementation of the ssh protocol because i didn't like the currently public ones. Not any allowed you to import and use the functions as a powerful library, and so i worked on a library-based SSH implementation which was non-existing in the free and open source software world.
How/Who?
If you downloaded this file, you must know what it is : a library for accessing ssh client services through C libraries calls in a simple manner. Everybody can use this software under the terms of the LGPL - see the COPYING file
If you ask yourself how to compile libssh, please read INSTALL before anything.
Where ?
Contributing
Please read the file 'CONTRIBUTING.md' next to this README file. It explains our copyright policy and how you should send patches for upstream inclusion.
Have fun and happy libssh hacking!
The libssh Team