lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00
Code Activity

openssl: fix potential OOB read/write with AES-GCM in ssh2_cipher_crypt()

Browse Source 
By applying two bounds checks to non-debug builds.

Reported-by: Vladimir Eli Tokarev
Fixes GHSA-c4f7-cvfc-33j7
Follow-up to 3c953c05d6 #797

Closes #2401
This commit is contained in:
Viktor Szakats
2026-07-23 10:32:04 +02:00
parent 74a09eb26e
commit a2ed82d409
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/openssl.c
View File

@@ -945,13 +945,15 @@ int ssh2_cipher_crypt(ssh2_cipher_ctx *ctx, SSH2_CIPHER_T(algo), int encrypt,
const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
/* size of AT, if present */
const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
/* length to encrypt */
const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
unsigned int cryptlen; /* length to encrypt */
(void)algo;
assert(blocksize <= sizeof(buf));
assert(cryptlen >= 0);
if(blocksize > sizeof(buf) ||
blocksize < (size_t)(aadlen + authenticationtag))
return 1;
cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
#if LIBSSH2_AES_GCM
/* First block */