Skip to content

Commit 8f7da4f

Browse files
MingcongBaiOriginCode
MingcongBai
authored and
OriginCode
committed
Track patches at AOSC-Tracking/libssh2 @ aosc/libssh2-1.11.1 (HEAD: a1d36ccc365d6941cd63102348966e7444365639).
1 parent fb12c4a commit 8f7da4f

7 files changed

Lines changed: 1334 additions & 1 deletion

‎runtime-network/libssh2/autobuild/defines‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
PKGNAME=libssh2
22
PKGSEC=libs
33
PKGDEP="openssl zlib"
4-
PKGDES="A client-side C library implementing the SSH2 protocol"
4+
PKGDES="Client-side C library to implement the SSH2 protocol"
55

66
ABTYPE=cmakeninja

‎runtime-network/libssh2/autobuild/patches/0001-UPSTREAM-userauth.c-username_len-bounds-checking-185.patch‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
From 4e95b12381dc5fc90fcbcec0c2778622a9e9c34c Mon Sep 17 00:00:00 2001
2+
From: Will Cosgrove <will@panic.com>
3+
Date: Mon, 13 Apr 2026 11:18:25 -0700
4+
Subject: [PATCH 1/5] UPSTREAM: userauth.c: username_len bounds checking
5+
(#1858)
6+
7+
Return errors when username_len will exceed bounds, fix existing bounds
8+
check.
9+
10+
Credit:
11+
[dapickle](https://github.com/dapickle)
12+
13+
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
14+
---
15+
src/userauth.c | 13 ++++++++++++-
16+
1 file changed, 12 insertions(+), 1 deletion(-)
17+
18+
diff --git a/src/userauth.c b/src/userauth.c
19+
index 0040c3fa..588b83f2 100644
20+
--- a/src/userauth.c
21+
+++ b/src/userauth.c
22+
@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
23+
memset(&session->userauth_list_packet_requirev_state, 0,
24+
sizeof(session->userauth_list_packet_requirev_state));
25+
26+
+ if(username_len > UINT32_MAX - 27) {
27+
+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
28+
+ "username_len out of bounds");
29+
+ return NULL;
30+
+ }
31+
+
32+
session->userauth_list_data_len = username_len + 27;
33+
34+
s = session->userauth_list_data =
35+
@@ -307,6 +313,11 @@ userauth_password(LIBSSH2_SESSION *session,
36+
* 40 = packet_type(1) + username_len(4) + service_len(4) +
37+
* service(14)"ssh-connection" + method_len(4) + method(8)"password" +
38+
* chgpwdbool(1) + password_len(4) */
39+
+ if(username_len > UINT32_MAX - 40) {
40+
+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
41+
+ "username_len out of bounds");
42+
+ }
43+
+
44+
session->userauth_pswd_data_len = username_len + 40;
45+
46+
session->userauth_pswd_data0 =
47+
@@ -447,7 +458,7 @@ password_response:
48+
}
49+
50+
/* basic data_len + newpw_len(4) */
51+
- if(username_len + password_len + 44 <= UINT_MAX) {
52+
+ if(username_len <= UINT32_MAX - password_len - 44) {
53+
session->userauth_pswd_data_len =
54+
username_len + password_len + 44;
55+
s = session->userauth_pswd_data =
56+
--
57+
2.52.0
58+

‎runtime-network/libssh2/autobuild/patches/0002-BACKPORT-UPSTREAM-Update-sftp_symlink-to-avoid-out-o.patch‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
From b49d2946b10ebc673688a13eff4243e9b18cab0e Mon Sep 17 00:00:00 2001
2+
From: Will Cosgrove <will@panic.com>
3+
Date: Fri, 10 Oct 2025 08:26:20 -0700
4+
Subject: [PATCH 2/5] BACKPORT: UPSTREAM: Update sftp_symlink to avoid out of
5+
bounds read on malformed packet #1705 (#1717)
6+
7+
Use buffer struct to guard against out of bounds reads and invalid packets.
8+
9+
Discovery Credit:
10+
Joshua Rogers
11+
12+
[ Mingcong Bai: Resolved a minor merge conflict in
13+
src/sftp.c ]
14+
15+
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
16+
---
17+
src/sftp.c | 66 ++++++++++++++++++++++++++++++++++++++----------------
18+
1 file changed, 47 insertions(+), 19 deletions(-)
19+
20+
diff --git a/src/sftp.c b/src/sftp.c
21+
index 6ede3111..43b6ff90 100644
22+
--- a/src/sftp.c
23+
+++ b/src/sftp.c
24+
@@ -3795,15 +3795,19 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
25+
{
26+
LIBSSH2_CHANNEL *channel = sftp->channel;
27+
LIBSSH2_SESSION *session = channel->session;
28+
- size_t data_len = 0, link_len;
29+
+ size_t data_len = 0, lk_len;
30+
/* 13 = packet_len(4) + packet_type(1) + request_id(4) + path_len(4) */
31+
ssize_t packet_len =
32+
path_len + 13 +
33+
((link_type == LIBSSH2_SFTP_SYMLINK) ? (4 + target_len) : 0);
34+
unsigned char *s, *data = NULL;
35+
+ struct string_buf buf;
36+
static const unsigned char link_responses[2] =
37+
{ SSH_FXP_NAME, SSH_FXP_STATUS };
38+
int retcode;
39+
+ unsigned char packet_type;
40+
+ uint32_t tmp_u32;
41+
+ unsigned char *lk_target;
42+
43+
if(sftp->symlink_state == libssh2_NB_state_idle) {
44+
sftp->last_errno = LIBSSH2_FX_OK;
45+
@@ -3891,8 +3895,25 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
46+
47+
sftp->symlink_state = libssh2_NB_state_idle;
48+
49+
- if(data[0] == SSH_FXP_STATUS) {
50+
- retcode = _libssh2_ntohu32(data + 5);
51+
+ buf.data = (unsigned char *)LIBSSH2_UNCONST(data);
52+
+ buf.dataptr = buf.data;
53+
+ buf.len = data_len;
54+
+
55+
+ if(_libssh2_get_byte(&buf, &packet_type)) {
56+
+ LIBSSH2_FREE(session, data);
57+
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
58+
+ "SFTP Protocol Error (type)");
59+
+ }
60+
+
61+
+ if(packet_type == SSH_FXP_STATUS) {
62+
+ if(_libssh2_get_u32(&buf, &tmp_u32)) {
63+
+ LIBSSH2_FREE(session, data);
64+
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
65+
+ "SFTP Protocol Error (code)");
66+
+ }
67+
+
68+
+ retcode = (int)tmp_u32;
69+
+
70+
LIBSSH2_FREE(session, data);
71+
if(retcode == LIBSSH2_FX_OK)
72+
return LIBSSH2_ERROR_NONE;
73+
@@ -3903,30 +3924,37 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
74+
}
75+
}
76+
77+
- if(_libssh2_ntohu32(data + 5) < 1) {
78+
+ /* advance past id */
79+
+ if(_libssh2_get_u32(&buf, &tmp_u32)) {
80+
LIBSSH2_FREE(session, data);
81+
return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
82+
- "Invalid READLINK/REALPATH response, "
83+
- "no name entries");
84+
+ "SFTP Protocol Error (id)");
85+
}
86+
87+
- if(data_len < 13) {
88+
- if(data_len > 0) {
89+
- LIBSSH2_FREE(session, data);
90+
- }
91+
+ /* look for at least one link */
92+
+ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
93+
+ LIBSSH2_FREE(session, data);
94+
return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
95+
- "SFTP stat packet too short");
96+
+ "Invalid READLINK/REALPATH response, "
97+
+ "no name entries");
98+
}
99+
100+
- /* this reads a u32 and stores it into a signed 32bit value */
101+
- link_len = _libssh2_ntohu32(data + 9);
102+
- if(link_len < target_len) {
103+
- memcpy(target, data + 13, link_len);
104+
- target[link_len] = 0;
105+
- retcode = (int)link_len;
106+
+ if(_libssh2_get_string(&buf, &lk_target, &lk_len) == LIBSSH2_ERROR_NONE) {
107+
+ if(lk_len < target_len) {
108+
+ memcpy(target, lk_target, lk_len);
109+
+ target[lk_len] = '\0';
110+
+ retcode = (int)lk_len;
111+
+ }
112+
+ else {
113+
+ retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
114+
+ }
115+
}
116+
- else
117+
- retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
118+
+ else {
119+
+ LIBSSH2_FREE(session, data);
120+
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
121+
+ "SFTP Protocol Error (filename)");
122+
+ }
123+
+
124+
LIBSSH2_FREE(session, data);
125+
126+
return retcode;
127+
--
128+
2.52.0
129+

‎runtime-network/libssh2/autobuild/patches/0003-UPSTREAM-packet-check-_libssh2_get_string-return-in-.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 8fb49a709b95af64db11282778481a584bcf6ce8 Mon Sep 17 00:00:00 2001
2+
From: TristanInSec <tristan.mtn@gmail.com>
3+
Date: Wed, 15 Apr 2026 14:51:08 -0400
4+
Subject: [PATCH 3/5] UPSTREAM: packet: check `_libssh2_get_string()` return in
5+
`EXT_INFO` handler
6+
7+
The `SSH_MSG_EXT_INFO` handler discards the return values from
8+
`_libssh2_get_string()` when parsing extension name/value pairs. When
9+
the buffer is exhausted before all claimed extensions are parsed,
10+
the loop continues with no-op iterations until `nr_extensions` reaches
11+
zero.
12+
13+
The `nr_extensions >= 1024` cap limits the worst case, but the loop
14+
should still break on parse failure for correctness and consistency
15+
with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
16+
`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
17+
18+
Closes #1864
19+
20+
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
21+
---
22+
src/packet.c | 6 ++++--
23+
1 file changed, 4 insertions(+), 2 deletions(-)
24+
25+
diff --git a/src/packet.c b/src/packet.c
26+
index 6da14e9f..ebaddae5 100644
27+
--- a/src/packet.c
28+
+++ b/src/packet.c
29+
@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
30+
31+
nr_extensions -= 1;
32+
33+
- _libssh2_get_string(&buf, &name, &name_len);
34+
- _libssh2_get_string(&buf, &value, &value_len);
35+
+ if(_libssh2_get_string(&buf, &name, &name_len))
36+
+ break;
37+
+ if(_libssh2_get_string(&buf, &value, &value_len))
38+
+ break;
39+
40+
if(name && value) {
41+
_libssh2_debug((session,
42+
--
43+
2.52.0
44+

‎runtime-network/libssh2/autobuild/patches/0004-BACKPORT-UPSTREAM-transport.c-Additional-boundary-ch.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From 213b0608f99b5b5793d42167a1d819c4ddfa48d4 Mon Sep 17 00:00:00 2001
2+
From: Will Cosgrove <will@panic.com>
3+
Date: Fri, 12 Jun 2026 15:57:44 -0700
4+
Subject: [PATCH 4/5] BACKPORT: UPSTREAM: transport.c: Additional boundary
5+
checks for packet length (#2052)
6+
7+
Add additional bounds checking on packet length to prevent OOB write.
8+
9+
Credit: [TristanInSec](https://github.com/TristanInSec)
10+
11+
[ Mingcong Bai: Resolved a minor merge conflict in
12+
src/transport.c ]
13+
14+
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
15+
---
16+
src/transport.c | 6 +++++-
17+
1 file changed, 5 insertions(+), 1 deletion(-)
18+
19+
diff --git a/src/transport.c b/src/transport.c
20+
index e1120656..d147505b 100644
21+
--- a/src/transport.c
22+
+++ b/src/transport.c
23+
@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
24+
total_num = 4;
25+
26+
p->packet_length = _libssh2_ntohu32(block);
27+
- if(p->packet_length < 1)
28+
+ if(p->packet_length < 1) {
29+
return LIBSSH2_ERROR_DECRYPT;
30+
+ }
31+
+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
32+
+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
33+
+ }
34+
35+
/* total_num may include size field, however due to existing
36+
* logic it needs to be removed after the entire packet is read
37+
--
38+
2.52.0
39+

0 commit comments

Comments
 (0)