channels: Avoid remote window overflow

Reported-by: Rinku Das <rinkudaskajal7857@gmail.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
(cherry picked from commit d0f5747ab7)

src/channels.c

@@ -565,6 +565,15 @@ SSH_PACKET_CALLBACK(channel_rcv_change_window)
 
     was_empty = channel->remote_window == 0;
 
+    if (UINT32_MAX - channel->remote_window < bytes) {
+        ssh_set_error(session,
+                      SSH_FATAL,
+                      "Window adjust %" PRIu32 " overflows remote window.",
+                      bytes);
+        session->session_state = SSH_SESSION_STATE_ERROR;
+        return SSH_PACKET_USED;
+    }
+
     channel->remote_window += bytes;
 
     /* Writing to the channel is non-blocking until the receive window is empty.