9e3f4b36c8
Resolves: RHEL-213033 Resolves: RHEL-213041 Resolves: RHEL-213047 Resolves: RHEL-213081 Resolves: RHEL-213114 Resolves: RHEL-213119 Resolves: RHEL-213151
38 lines
1.1 KiB
Diff
38 lines
1.1 KiB
Diff
From 2b2dad066dbee0077e1214a8ec40386fc39f44f3 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Wed, 1 Jul 2026 16:43:08 +0200
|
|
Subject: [PATCH 12/12] CVE-2026-59850 channels: Avoid processing DATA packets
|
|
on closed channels
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
|
|
(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a)
|
|
---
|
|
src/channels.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/src/channels.c b/src/channels.c
|
|
index 2b84352f..1c86fde8 100644
|
|
--- a/src/channels.c
|
|
+++ b/src/channels.c
|
|
@@ -590,6 +590,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){
|
|
return SSH_PACKET_USED;
|
|
}
|
|
|
|
+ if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) {
|
|
+ SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel");
|
|
+ ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel");
|
|
+ SSH_STRING_FREE(str);
|
|
+ return SSH_PACKET_USED;
|
|
+ }
|
|
+
|
|
if (len <= channel->local_window) {
|
|
channel->local_window -= len;
|
|
} else {
|
|
--
|
|
2.54.0
|
|
|