lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-27 13:21:11 +03:00
Code Activity

sftp: Fix a possible integer overflow.

Browse Source 
CID: #1238630

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Aris Adamantiadis <aris@0xbadc0de.be>
This commit is contained in:
Andreas Schneider
2015-01-14 11:16:59 +01:00
parent ce02f6576a
commit af0dd3fb02
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/sftp.c
View File

@@ -340,7 +340,6 @@ sftp_packet sftp_packet_read(sftp_session sftp) {
return NULL; return NULL;
} }
size = ntohl(size);
r=ssh_channel_read(sftp->channel, buffer, 1, 0); r=ssh_channel_read(sftp->channel, buffer, 1, 0);
if (r <= 0) { if (r <= 0) {
/* TODO: check if there are cases where an error needs to be set here */ /* TODO: check if there are cases where an error needs to be set here */
@@ -350,7 +349,12 @@ sftp_packet sftp_packet_read(sftp_session sftp) {
} }
ssh_buffer_add_data(packet->payload, buffer, r); ssh_buffer_add_data(packet->payload, buffer, r);
buffer_get_u8(packet->payload, &packet->type); buffer_get_u8(packet->payload, &packet->type);
size=size-1;
size = ntohl(size);
if (size == 0) {
return packet;
}
size--;
while (size>0){ while (size>0){
r=ssh_channel_read(sftp->channel,buffer, r=ssh_channel_read(sftp->channel,buffer,
sizeof(buffer)>size ? size:sizeof(buffer),0); sizeof(buffer)>size ? size:sizeof(buffer),0);