9e3f4b36c8
Resolves: RHEL-213033 Resolves: RHEL-213041 Resolves: RHEL-213047 Resolves: RHEL-213081 Resolves: RHEL-213114 Resolves: RHEL-213119 Resolves: RHEL-213151
46 lines
1.4 KiB
Diff
46 lines
1.4 KiB
Diff
From 7baf12bd38832bf7425de45e8f32d48af3e7fb7c Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
|
|
Date: Fri, 6 Mar 2026 18:05:29 +0100
|
|
Subject: [PATCH 02/12] CVE-2026-59844 sftpserver: cap accepted values of len
|
|
in SSH_FXP_READ
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The client-provided length is directly used in
|
|
a malloc in process_read(), so not restricting it
|
|
leads to allocations bounded only by UINT32_MAX.
|
|
|
|
The new cap is the same as the one currently used
|
|
by OpenSSH.
|
|
|
|
Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
|
|
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
|
|
(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)
|
|
---
|
|
src/sftpserver.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/src/sftpserver.c b/src/sftpserver.c
|
|
index 528ef6f9..60f90714 100644
|
|
--- a/src/sftpserver.c
|
|
+++ b/src/sftpserver.c
|
|
@@ -105,6 +105,14 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) {
|
|
sftp_client_message_free(msg);
|
|
return NULL;
|
|
}
|
|
+ if (msg->len > MAX_PACKET_LEN - 1024) {
|
|
+ ssh_set_error(sftp->session,
|
|
+ SSH_FATAL,
|
|
+ "Too large SSH_FXP_READ length: %" PRIu32,
|
|
+ msg->len);
|
|
+ sftp_client_message_free(msg);
|
|
+ return NULL;
|
|
+ }
|
|
break;
|
|
case SSH_FXP_WRITE:
|
|
rc = ssh_buffer_unpack(payload,
|
|
--
|
|
2.54.0
|
|
|