mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
01d0c895fa
`wcng_privatekey_from_point()` sizes the ECC private-key blob with
`sizeof(BCRYPT_ECCPRIVATE_BLOB)`, but that name is the wide blob-type
string `L"ECCPRIVATEBLOB"`, not a struct, so the `sizeof` measures the
string (30 bytes on Windows) rather than the 8-byte `BCRYPT_ECCKEY_BLOB`
header. The three `memcpy` offsets right below it, and the public-key
sibling `wcng_publickey_from_point()`, already use
`sizeof(BCRYPT_ECCKEY_BLOB)`, so the buffer ends up oversized and its
uninitialized tail is handed to `BCryptImportKeyPair()` with an inflated
`cbInput`. This is on the path that loads an OpenSSH-format ECDSA
private key through
`libssh2_userauth_publickey_frommemory()`/`fromfile()` on the CNG
backend.
Using `sizeof(BCRYPT_ECCKEY_BLOB)` lines the allocation up with the
header the copies actually write from and with the length passed to
`BCryptImportKeyPair()`. Keeping it in step with the public-key path
means the private blob is described to CNG with exactly the bytes it
holds.
Follow-up to 3e72343737 #1315
Closes #2631
libssh2 - SSH2 library
libssh2 is a library implementing the SSH2 protocol, available under the revised BSD license.
Installation instructions: