openssh/openssh-9.9p1-reject-null-char-in-url-string.patch
Zoltan Fridrich 40f5f26708 CVE-2025-61985: Reject URL-strings with NULL characters
Resolves: RHEL-128388

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
2025-12-05 10:27:33 +01:00

25 lines
734 B
Diff

diff --color -ruNp a/misc.c b/misc.c
--- a/misc.c 2025-12-03 16:19:11.255135131 +0100
+++ b/misc.c 2025-12-03 16:21:53.769590836 +0100
@@ -998,7 +998,7 @@ urldecode(const char *src)
size_t srclen;
if ((srclen = strlen(src)) >= SIZE_MAX)
- fatal_f("input too large");
+ return NULL;
ret = xmalloc(srclen + 1);
for (dst = ret; *src != '\0'; src++) {
switch (*src) {
@@ -1006,9 +1006,10 @@ urldecode(const char *src)
*dst++ = ' ';
break;
case '%':
+ /* note: don't allow \0 characters */
if (!isxdigit((unsigned char)src[1]) ||
!isxdigit((unsigned char)src[2]) ||
- (ch = hexchar(src + 1)) == -1) {
+ (ch = hexchar(src + 1)) == -1 || ch == 0) {
free(ret);
return NULL;
}