lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00
Code Activity

wincng: fix ECC private key blob allocation size

Browse Source 
`wcng_privatekey_from_point()` sizes the ECC private-key blob with
`sizeof(BCRYPT_ECCPRIVATE_BLOB)`, but that name is the wide blob-type
string `L"ECCPRIVATEBLOB"`, not a struct, so the `sizeof` measures the
string (30 bytes on Windows) rather than the 8-byte `BCRYPT_ECCKEY_BLOB`
header. The three `memcpy` offsets right below it, and the public-key
sibling `wcng_publickey_from_point()`, already use
`sizeof(BCRYPT_ECCKEY_BLOB)`, so the buffer ends up oversized and its
uninitialized tail is handed to `BCryptImportKeyPair()` with an inflated
`cbInput`. This is on the path that loads an OpenSSH-format ECDSA
private key through
`libssh2_userauth_publickey_frommemory()`/`fromfile()` on the CNG
backend.

Using `sizeof(BCRYPT_ECCKEY_BLOB)` lines the allocation up with the
header the copies actually write from and with the length passed to
`BCryptImportKeyPair()`. Keeping it in step with the public-key path
means the private blob is described to CNG with exactly the bytes it
holds.

Follow-up to 3e72343737 #1315

Closes #2631
This commit is contained in:
syed abdul khaliq
2026-09-29 20:23:44 +05:30
committed by Viktor Szakats
parent a95ed7d84a
commit 01d0c895fa
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/wincng.c
View File

@@ -1822,7 +1822,7 @@ static int wcng_privatekey_from_point(IN LIBSSH2_SESSION *session,
/* Initialize a blob to import */
ecc_blob_len =
sizeof(BCRYPT_ECCPRIVATE_BLOB) + q->x_len + q->y_len + d_len;
sizeof(BCRYPT_ECCKEY_BLOB) + q->x_len + q->y_len + d_len;
ecc_blob = SSH2_ALLOC(session, ecc_blob_len);
if(!ecc_blob)
return LIBSSH2_ERROR_ALLOC;