From 49df3fa0dcc58d70751b893cd9a25780c9bf935a Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Thu, 5 Mar 2026 17:35:10 +0100
Subject: [PATCH] channels: Avoid remote window overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported-by: Rinku Das <rinkudaskajal7857@gmail.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
(cherry picked from commit d0f5747ab7ab1732671793f135b6c0065ce950cf)
---
 src/channels.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/channels.c b/src/channels.c
index 0d19b046..1c59cc10 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -565,6 +565,15 @@ SSH_PACKET_CALLBACK(channel_rcv_change_window)
 
     was_empty = channel->remote_window == 0;
 
+    if (UINT32_MAX - channel->remote_window < bytes) {
+        ssh_set_error(session,
+                      SSH_FATAL,
+                      "Window adjust %" PRIu32 " overflows remote window.",
+                      bytes);
+        session->session_state = SSH_SESSION_STATE_ERROR;
+        return SSH_PACKET_USED;
+    }
+
     channel->remote_window += bytes;
 
     /* Writing to the channel is non-blocking until the receive window is empty.