a97adc51f9
Resolves: RHEL-215674 Resolves: RHEL-215675 Resolves: RHEL-215676 Resolves: RHEL-215677 Resolves: RHEL-215678 Resolves: RHEL-215679 Resolves: RHEL-215680 Assisted-by: Ymir
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 0647bf3cc06e4bac01596b4f8ca8e00ee4148ca5 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
|
|
Date: Fri, 6 Mar 2026 18:05:29 +0100
|
|
Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len in
|
|
SSH_FXP_READ
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The client-provided length is directly used in
|
|
a malloc in process_read(), so not restricting it
|
|
leads to allocations bounded only by UINT32_MAX.
|
|
|
|
The new cap is the same as the one currently used
|
|
by OpenSSH.
|
|
|
|
Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
|
|
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
|
|
(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)
|
|
---
|
|
src/sftpserver.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/src/sftpserver.c b/src/sftpserver.c
|
|
index b3349e16..34bea3d9 100644
|
|
--- a/src/sftpserver.c
|
|
+++ b/src/sftpserver.c
|
|
@@ -105,6 +105,14 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) {
|
|
sftp_client_message_free(msg);
|
|
return NULL;
|
|
}
|
|
+ if (msg->len > MAX_PACKET_LEN - 1024) {
|
|
+ ssh_set_error(session,
|
|
+ SSH_FATAL,
|
|
+ "Too large SSH_FXP_READ length: %" PRIu32,
|
|
+ msg->len);
|
|
+ sftp_client_message_free(msg);
|
|
+ return NULL;
|
|
+ }
|
|
break;
|
|
case SSH_FXP_WRITE:
|
|
rc = ssh_buffer_unpack(payload,
|