lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00
Code Activity

wincng: cap private key components in wcng_pub_privkey_file_parse()

Browse Source 
When parsing private key files/blobs. To avoid a corrupt/crafted RSA or
DSA private file cause internal size overflows.

Reported by Copilot
Bug: https://github.com/libssh2/libssh2/pull/2376#discussion_r3622147943
Bug: https://github.com/libssh2/libssh2/pull/2376#discussion_r3622147965

Closes #2378
This commit is contained in:
Viktor Szakats
2026-07-21 15:04:53 +02:00
parent 00986be1d3
commit 16879e47b8
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/wincng.c
View File

@@ -2760,6 +2760,10 @@ static int wcng_pub_privkey_file_parse(LIBSSH2_SESSION *session,
goto cleanup;
memcpy(method_buf, "ssh-rsa", method_buf_len);
if(rcbDecoded[2] > (32 * 1024) ||
rcbDecoded[1] > (32 * 1024))
goto cleanup;
keylen = 4 + method_buf_len +
4 + rcbDecoded[2] +
4 + rcbDecoded[1];
@@ -2779,6 +2783,12 @@ static int wcng_pub_privkey_file_parse(LIBSSH2_SESSION *session,
goto cleanup;
memcpy(method_buf, "ssh-dss", method_buf_len);
if(rcbDecoded[1] > (32 * 1024) ||
rcbDecoded[2] > (32 * 1024) ||
rcbDecoded[3] > (32 * 1024) ||
rcbDecoded[4] > (32 * 1024))
goto cleanup;
keylen = 4 + method_buf_len +
4 + rcbDecoded[1] +
4 + rcbDecoded[2] +