blob: dae5db1c25d1ac488d0ed3048d10b2ec56838211 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
https://bugs.gentoo.org/977961#c11
--- a/src/transport.c 2024-10-16 10:03:21.000000000 +0200
+++ b/src/transport.c 2026-07-07 02:38:20.942968610 +0200
@@ -639,8 +639,12 @@
total_num = 4;
p->packet_length = _libssh2_ntohu32(block);
- if(p->packet_length < 1)
+ if(p->packet_length < 1) {
return LIBSSH2_ERROR_DECRYPT;
+ }
+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+ }
/* total_num may include size field, however due to existing
* logic it needs to be removed after the entire packet is read
|
