lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00
Code Activity

channel, packet: validate packet size received from server

Browse Source 
To avoid continuing with a zero value and entering a busy-loop.

Reported-by: Nora-Qiu
Fixes GHSA-4q73-hh48-fmr8

Closes #2582
This commit is contained in:
Viktor Szakats
2026-09-03 20:18:12 +02:00
parent 9438f90ae0
commit b5c37a910d
2 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/channel.c
View File

@@ -230,14 +230,21 @@ LIBSSH2_CHANNEL *ssh2_channel_open(LIBSSH2_SESSION *session,
goto channel_error;
}
packet_size = ssh2_ntohu32(session->open_data + 13);
if(!packet_size) {
ssh2_err(session, LIBSSH2_ERROR_CHANNEL_FAILURE,
"Invalid packet size received from server");
goto channel_error;
}
session->open_channel->remote.id =
ssh2_ntohu32(session->open_data + 5);
session->open_channel->local.window_size =
ssh2_ntohu32(session->open_data + 9);
session->open_channel->local.window_size_initial =
ssh2_ntohu32(session->open_data + 9);
session->open_channel->local.packet_size =
ssh2_ntohu32(session->open_data + 13);
session->open_channel->local.packet_size = packet_size;
ssh2_deb((session, LIBSSH2_TRACE_CONN,
"Connection Established - ID: %u/%u win: %u/%u"
" pack: %u/%u",

22
src/packet.c
View File

@@ -132,6 +132,14 @@ static SSH2_INLINE int packet_queue_listener(
break;
}
if(!listen_state->packet_size) {
ssh2_deb((session, LIBSSH2_TRACE_CONN,
"Invalid packet size received from server"));
failure_code = SSH_OPEN_CONNECT_FAILED;
listen_state->state = ssh2_NB_state_sent;
break;
}
channel = SSH2_CALLOC(session, sizeof(LIBSSH2_CHANNEL));
if(!channel) {
ssh2_err(session, LIBSSH2_ERROR_ALLOC,
@@ -325,6 +333,13 @@ static SSH2_INLINE int packet_x11_open(
if(session->x11) {
if(x11open_state->state == ssh2_NB_state_allocated) {
if(!x11open_state->packet_size) {
ssh2_deb((session, LIBSSH2_TRACE_CONN,
"Invalid packet size received from server"));
failure_code = SSH_OPEN_CONNECT_FAILED;
goto x11_exit;
}
channel = SSH2_CALLOC(session, sizeof(LIBSSH2_CHANNEL));
if(!channel) {
ssh2_err(session, LIBSSH2_ERROR_ALLOC,
@@ -476,6 +491,13 @@ static SSH2_INLINE int packet_authagent_open(
if(session->authagent) {
if(authagent_state->state == ssh2_NB_state_allocated) {
if(!authagent_state->packet_size) {
ssh2_deb((session, LIBSSH2_TRACE_CONN,
"Invalid packet size received from server"));
failure_code = SSH_OPEN_CONNECT_FAILED;
goto authagent_exit;
}
channel = SSH2_CALLOC(session, sizeof(LIBSSH2_CHANNEL));
authagent_state->channel = channel;