From 91360acc9f2cd3295fbeff03b448fab912426325 Mon Sep 17 00:00:00 2001
From: TristanInSec <tristan.mtn@gmail.com>
Date: Wed, 15 Apr 2026 14:51:08 -0400
Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
 handler

The `SSH_MSG_EXT_INFO` handler discards the return values from
`_libssh2_get_string()` when parsing extension name/value pairs. When
the buffer is exhausted before all claimed extensions are parsed,
the loop continues with no-op iterations until `nr_extensions` reaches
zero.

The `nr_extensions >= 1024` cap limits the worst case, but the loop
should still break on parse failure for correctness and consistency
with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.

Closes #1864
---
 src/packet.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/packet.c b/src/packet.c
index 6da14e9f..ebaddae5 100644
--- a/src/packet.c
+++ b/src/packet.c
@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
 
                     nr_extensions -= 1;
 
-                    _libssh2_get_string(&buf, &name, &name_len);
-                    _libssh2_get_string(&buf, &value, &value_len);
+                    if(_libssh2_get_string(&buf, &name, &name_len))
+                        break;
+                    if(_libssh2_get_string(&buf, &value, &value_len))
+                        break;
 
                     if(name && value) {
                         _libssh2_debug((session,
