lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-05 09:30:35 +03:00
Code Activity

Defend against possible integer overflows in comp_method_zlib_decomp.

Browse Source
This commit is contained in:
Michael Buckley
2018-12-03 14:38:42 -08:00
parent dc109a7f51
commit 76727cf476
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/comp.c
View File

@@ -225,7 +225,12 @@ comp_method_zlib_decomp(LIBSSH2_SESSION * session,
/* A short-term alloc of a full data chunk is better than a series of /* A short-term alloc of a full data chunk is better than a series of
reallocs */ reallocs */
char *out; char *out;
int out_maxlen = 4 * src_len; size_t out_maxlen = src_len;
if (src_len <= SIZE_MAX / 4)
out_maxlen = src_len * 4;
else
out_maxlen = payload_limit;
/* If strm is null, then we have not yet been initialized. */ /* If strm is null, then we have not yet been initialized. */
if(strm == NULL) if(strm == NULL)
@@ -274,7 +279,7 @@ comp_method_zlib_decomp(LIBSSH2_SESSION * session,
"decompression failure"); "decompression failure");
} }
if(out_maxlen >= (int) payload_limit) { if(out_maxlen > (int) payload_limit || out_maxlen > SIZE_MAX / 2) {
LIBSSH2_FREE(session, out); LIBSSH2_FREE(session, out);
return _libssh2_error(session, LIBSSH2_ERROR_ZLIB, return _libssh2_error(session, LIBSSH2_ERROR_ZLIB,
"Excessive growth in decompression phase"); "Excessive growth in decompression phase");