From 01d0c895faa8d5584115ad42d0958d19fee6ff2c Mon Sep 17 00:00:00 2001 From: syed abdul khaliq Date: Tue, 29 Sep 2026 20:23:44 +0530 Subject: [PATCH] wincng: fix ECC private key blob allocation size `wcng_privatekey_from_point()` sizes the ECC private-key blob with `sizeof(BCRYPT_ECCPRIVATE_BLOB)`, but that name is the wide blob-type string `L"ECCPRIVATEBLOB"`, not a struct, so the `sizeof` measures the string (30 bytes on Windows) rather than the 8-byte `BCRYPT_ECCKEY_BLOB` header. The three `memcpy` offsets right below it, and the public-key sibling `wcng_publickey_from_point()`, already use `sizeof(BCRYPT_ECCKEY_BLOB)`, so the buffer ends up oversized and its uninitialized tail is handed to `BCryptImportKeyPair()` with an inflated `cbInput`. This is on the path that loads an OpenSSH-format ECDSA private key through `libssh2_userauth_publickey_frommemory()`/`fromfile()` on the CNG backend. Using `sizeof(BCRYPT_ECCKEY_BLOB)` lines the allocation up with the header the copies actually write from and with the length passed to `BCryptImportKeyPair()`. Keeping it in step with the public-key path means the private blob is described to CNG with exactly the bytes it holds. Follow-up to 3e72343737e5b17ac98236c03d5591d429b119ae #1315 Closes #2631 --- src/wincng.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wincng.c b/src/wincng.c index 10fc97c6..3a92425b 100644 --- a/src/wincng.c +++ b/src/wincng.c @@ -1822,7 +1822,7 @@ static int wcng_privatekey_from_point(IN LIBSSH2_SESSION *session, /* Initialize a blob to import */ ecc_blob_len = - sizeof(BCRYPT_ECCPRIVATE_BLOB) + q->x_len + q->y_len + d_len; + sizeof(BCRYPT_ECCKEY_BLOB) + q->x_len + q->y_len + d_len; ecc_blob = SSH2_ALLOC(session, ecc_blob_len); if(!ecc_blob) return LIBSSH2_ERROR_ALLOC;