lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-20 02:42:09 +03:00
Code Activity

NULL terminate server_sign_algorithms string (#669)

Browse Source 
files: packet.c, libssh2_priv.h

notes:
* Fix heap buffer overflow in _libssh2_key_sign_algorithm

When allocating `session->server_sign_algorithms` which is a `char*` is is important to also allocate space for the string-terminating null byte at the end and make sure the string is actually null terminated.

Without this fix, the `strchr()` call inside the `_libssh2_key_sign_algorithm` (line 1219) function will try to parse the string and go out of buffer on the last invocation.

Credit: tihmstar
Co-authored-by: Will Cosgrove <will@panic.com>
This commit is contained in:
tihmstar
2022-02-03 19:11:36 +01:00
committed by GitHub
parent 30fc410b97
commit 2a2aaed3b6
2 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/libssh2_priv.h
View File

@@ -642,7 +642,6 @@ struct _LIBSSH2_SESSION
/* public key algorithms accepted as comma separated list */ /* public key algorithms accepted as comma separated list */
char *server_sign_algorithms; char *server_sign_algorithms;
size_t server_sign_algorithms_len;
/* key signing algorithm preferences -- NULL yields server order */ /* key signing algorithm preferences -- NULL yields server order */
char *sign_algo_prefs; char *sign_algo_prefs;

4
src/packet.c
View File

@@ -665,12 +665,12 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
session->server_sign_algorithms = session->server_sign_algorithms =
LIBSSH2_ALLOC(session, LIBSSH2_ALLOC(session,
value_len); value_len + 1);
if(session->server_sign_algorithms) { if(session->server_sign_algorithms) {
session->server_sign_algorithms_len = value_len;
memcpy(session->server_sign_algorithms, memcpy(session->server_sign_algorithms,
value, value_len); value, value_len);
session->server_sign_algorithms[value_len] = '\0';
} }
else { else {
rc = _libssh2_error(session, LIBSSH2_ERROR_ALLOC, rc = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,