From 16879e47b8d803228797a280336fa628fee2013f Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 21 Jul 2026 15:04:53 +0200 Subject: [PATCH] wincng: cap private key components in `wcng_pub_privkey_file_parse()` When parsing private key files/blobs. To avoid a corrupt/crafted RSA or DSA private file cause internal size overflows. Reported by Copilot Bug: https://github.com/libssh2/libssh2/pull/2376#discussion_r3622147943 Bug: https://github.com/libssh2/libssh2/pull/2376#discussion_r3622147965 Closes #2378 --- src/wincng.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/wincng.c b/src/wincng.c index e34e826b..0b36dd92 100644 --- a/src/wincng.c +++ b/src/wincng.c @@ -2760,6 +2760,10 @@ static int wcng_pub_privkey_file_parse(LIBSSH2_SESSION *session, goto cleanup; memcpy(method_buf, "ssh-rsa", method_buf_len); + if(rcbDecoded[2] > (32 * 1024) || + rcbDecoded[1] > (32 * 1024)) + goto cleanup; + keylen = 4 + method_buf_len + 4 + rcbDecoded[2] + 4 + rcbDecoded[1]; @@ -2779,6 +2783,12 @@ static int wcng_pub_privkey_file_parse(LIBSSH2_SESSION *session, goto cleanup; memcpy(method_buf, "ssh-dss", method_buf_len); + if(rcbDecoded[1] > (32 * 1024) || + rcbDecoded[2] > (32 * 1024) || + rcbDecoded[3] > (32 * 1024) || + rcbDecoded[4] > (32 * 1024)) + goto cleanup; + keylen = 4 + method_buf_len + 4 + rcbDecoded[1] + 4 + rcbDecoded[2] +