From d4e5780315c352a8b2957eb95072d74ff1cdcc7d Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 6 Oct 2026 18:27:27 +0200
Subject: [PATCH] comp: mitigate potential side-channel attack by disabling
 LZ77 in zlib compression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Note, this change lowers the compression level from 6 (default) to 1
(best speed).

Refs:
https://arxiv.org/pdf/2609.07709
https://www.openssh.org/txt/release-10.6
https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace
OpenBSD-Commit-ID: 839e5e53ad76786d0e90bed530304e4e13acbba0

Discovered-by: Fabian Bäumer
Discovered-by: Marcus Brinkmann
Based-on-patch-by: Job Snijders

Closes #2658
---
 src/comp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/comp.c b/src/comp.c
index 3b9c015b..d602f56e 100644
--- a/src/comp.c
+++ b/src/comp.c
@@ -142,7 +142,8 @@ static int comp_method_zlib_init(LIBSSH2_SESSION *session, int compr,
     strm->zalloc = (alloc_func)comp_method_zlib_alloc;
     strm->zfree = (free_func)comp_method_zlib_free;
     if(compr)
-        status = deflateInit(strm, Z_DEFAULT_COMPRESSION);
+        status = deflateInit2(strm, Z_BEST_SPEED, Z_DEFLATED, 15, 8,
+                              Z_HUFFMAN_ONLY);
     else
         status = inflateInit(strm);