mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
7b18532ca1
To complement/replace similar fixes made earlier to `ssh2_base64_encode()` and `knownhost_line()`, respectively. Until libssh2 1.11.1, `libssh2_knownhost_add*()` public APIs had a special behavior when they received `keylen == 0` argument. They automatically determined the length of the `key` buffer via `strlen()`. When passing zero length either on purpose or by accident, it could result in an OOB read if the buffer's actual length was zero. (Such case could also happen within libssh2's own code.) This behavior was not documented on the man page, but the public `libssh2.h` header mentioned it in comments. Earlier patch #1641 dropped this behavior for one codepath, which was a breaking change, arguably for the better. This patch fixes the remaining codepath and removes this behavior from these functions completely. They now return `LIBSSH2_ERROR_BAD_USE` when called with a zero `keylen` argument, with an explanatory error string. Recommended fix is passing `key` buffer length, or `strlen()` it at the call site if the buffer is null-terminated, and making sure the buffer is non-empty. Refs: https://github.com/libssh2/libssh2/pull/2363/files#diff-5182b571dc174e7b59106f0ea398a54784a0eb6c32eb95b9952cfa1aca893a71R8665e2d4d7905https://github.com/curl/curl/pull/18617 Follow-up to102e444846#2363 Follow-up tod1c0e14d2a#1641 Follow-up to4b991b232dCloses #2364