From 0647bf3cc06e4bac01596b4f8ca8e00ee4148ca5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Fri, 6 Mar 2026 18:05:29 +0100 Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len in SSH_FXP_READ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The client-provided length is directly used in a malloc in process_read(), so not restricting it leads to allocations bounded only by UINT32_MAX. The new cap is the same as the one currently used by OpenSSH. Signed-off-by: Pavol Žáčik Reviewed-by: Jakub Jelen (cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627) --- src/sftpserver.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/sftpserver.c b/src/sftpserver.c index b3349e16..34bea3d9 100644 --- a/src/sftpserver.c +++ b/src/sftpserver.c @@ -105,6 +105,14 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) { sftp_client_message_free(msg); return NULL; } + if (msg->len > MAX_PACKET_LEN - 1024) { + ssh_set_error(session, + SSH_FATAL, + "Too large SSH_FXP_READ length: %" PRIu32, + msg->len); + sftp_client_message_free(msg); + return NULL; + } break; case SSH_FXP_WRITE: rc = ssh_buffer_unpack(payload,