mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-08-05 12:38:09 -07:00
d1523c24e9
* Add CVE-2026-55199 fix * Rebase CVE-2026-7598 patch Just git mv as the additional fix is simple. Bug: https://bugs.gentoo.org/977961 Thanks-to: Kerin Millar <kfm@plushkava.net> Signed-off-by: Sam James <sam@gentoo.org>
53 lines
2.0 KiB
Diff
53 lines
2.0 KiB
Diff
https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
|
|
|
|
From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
|
|
From: Will Cosgrove <will@panic.com>
|
|
Date: Mon, 13 Apr 2026 11:18:25 -0700
|
|
Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
|
|
|
|
Return errors when username_len will exceed bounds, fix existing bounds
|
|
check.
|
|
|
|
Credit:
|
|
[dapickle](https://github.com/dapickle)
|
|
---
|
|
src/userauth.c | 13 ++++++++++++-
|
|
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
|
--- a/src/userauth.c 2024-10-16 10:03:21.000000000 +0200
|
|
+++ b/src/userauth.c 2026-07-07 02:06:46.665254174 +0200
|
|
@@ -80,6 +80,12 @@
|
|
memset(&session->userauth_list_packet_requirev_state, 0,
|
|
sizeof(session->userauth_list_packet_requirev_state));
|
|
|
|
+ if(username_len > UINT32_MAX - 27) {
|
|
+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
|
|
+ "username_len out of bounds");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
session->userauth_list_data_len = username_len + 27;
|
|
|
|
s = session->userauth_list_data =
|
|
@@ -307,6 +313,11 @@
|
|
* 40 = packet_type(1) + username_len(4) + service_len(4) +
|
|
* service(14)"ssh-connection" + method_len(4) + method(8)"password" +
|
|
* chgpwdbool(1) + password_len(4) */
|
|
+ if(username_len > UINT32_MAX - 40) {
|
|
+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
|
|
+ "username_len out of bounds");
|
|
+ }
|
|
+
|
|
session->userauth_pswd_data_len = username_len + 40;
|
|
|
|
session->userauth_pswd_data0 =
|
|
@@ -447,7 +458,7 @@
|
|
}
|
|
|
|
/* basic data_len + newpw_len(4) */
|
|
- if(username_len + password_len + 44 <= UINT_MAX) {
|
|
+ if(username_len <= UINT32_MAX - password_len - 44) {
|
|
session->userauth_pswd_data_len =
|
|
username_len + password_len + 44;
|
|
s = session->userauth_pswd_data =
|