sergioandClaude Opus 4.8
08fdec3bbf
La cola previa (115) se agoto/enveneno: ultimo seal 2026-06-25T16:42, ~63 recetas fallan por deps no importadas (go/libconfuse/protoc/liblzma) o C-heavy (libbpf). Diagnostico: el VPS giraba en falso re-confirmando cache-hits ya cosechados. - archiva la escoria de incoming/ (71 .toml + 38 .patch) a tandas/staged-2026-06-26/ - fuel-5: 18 candidatos CLI-Rust puro (anti-C); import 11/18 por nix, 10 pineados (aichat caligula cotp diskus otree pls projectable qrtool russ rwalk wthrr) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From 63e27b6855f2d8484379ad4b128680561b84e957 Mon Sep 17 00:00:00 2001
|
|
From: Will Cosgrove <will@panic.com>
|
|
Date: Fri, 12 Jun 2026 15:57:44 -0700
|
|
Subject: [PATCH] transport.c: Additional boundary checks for packet length
|
|
(#2052)
|
|
|
|
Add additional bounds checking on packet length to prevent OOB write.
|
|
|
|
Credit: [TristanInSec](https://github.com/TristanInSec)
|
|
|
|
Cherry-picked from 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8.
|
|
Co-authored-by: LN Liberda <lauren@selfisekai.rocks>
|
|
---
|
|
src/transport.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/transport.c b/src/transport.c
|
|
index e1120656..d147505b 100644
|
|
--- a/src/transport.c
|
|
+++ b/src/transport.c
|
|
@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
|
|
total_num = 4;
|
|
|
|
p->packet_length = _libssh2_ntohu32(block);
|
|
- if(p->packet_length < 1)
|
|
+ if(p->packet_length < 1) {
|
|
return LIBSSH2_ERROR_DECRYPT;
|
|
+ }
|
|
+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
|
|
+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
|
|
+ }
|
|
|
|
/* total_num may include size field, however due to existing
|
|
* logic it needs to be removed after the entire packet is read
|