40 lines
1.5 KiB
Diff
40 lines
1.5 KiB
Diff
From 91360acc9f2cd3295fbeff03b448fab912426325 Mon Sep 17 00:00:00 2001
|
|
From: TristanInSec <tristan.mtn@gmail.com>
|
|
Date: Wed, 15 Apr 2026 14:51:08 -0400
|
|
Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
|
|
handler
|
|
|
|
The `SSH_MSG_EXT_INFO` handler discards the return values from
|
|
`_libssh2_get_string()` when parsing extension name/value pairs. When
|
|
the buffer is exhausted before all claimed extensions are parsed,
|
|
the loop continues with no-op iterations until `nr_extensions` reaches
|
|
zero.
|
|
|
|
The `nr_extensions >= 1024` cap limits the worst case, but the loop
|
|
should still break on parse failure for correctness and consistency
|
|
with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
|
|
`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
|
|
|
|
Closes #1864
|
|
---
|
|
src/packet.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/packet.c b/src/packet.c
|
|
index 6da14e9f..ebaddae5 100644
|
|
--- a/src/packet.c
|
|
+++ b/src/packet.c
|
|
@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
|
|
|
|
nr_extensions -= 1;
|
|
|
|
- _libssh2_get_string(&buf, &name, &name_len);
|
|
- _libssh2_get_string(&buf, &value, &value_len);
|
|
+ if(_libssh2_get_string(&buf, &name, &name_len))
|
|
+ break;
|
|
+ if(_libssh2_get_string(&buf, &value, &value_len))
|
|
+ break;
|
|
|
|
if(name && value) {
|
|
_libssh2_debug((session,
|