Merge branch 'maint'

Author: Mikaka27

lib/ssh/src/ssh_sftpd.erl

@@ -264,7 +264,7 @@ handle_data(0, ChannelId, <<?UINT32(Len), Msg:Len/binary, Rest/binary>>,
     end;
 handle_data(0, _ChannelId, Data, State = #state{pending = <<>>}) ->
     {ok, State#state{pending = Data}};
-handle_data(Type, ChannelId, Data0, State = #state{pending = Pending}) ->
+handle_data(0, ChannelId, Data0, State = #state{pending = Pending}) ->
     Data = <<Pending/binary, Data0/binary>>,
     Size = byte_size(Data),
     case Size > ?SSH_MAX_PACKET_SIZE of
@@ -285,8 +285,11 @@ handle_data(Type, ChannelId, Data0, State = #state{pending = Pending}) ->
             ?LOG_ERROR(ReportFun, [Size]),
             {stop, ChannelId, State};
         _ ->
-            handle_data(Type, ChannelId, Data, State#state{pending = <<>>})
-    end.
+            handle_data(0, ChannelId, Data, State#state{pending = <<>>})
+    end;
+handle_data(_Type, _ChannelId, _Data, State) ->
+    %% Same as openssh sftpd, we ignore extended data
+    {ok, State}.
 
 %% From draft-ietf-secsh-filexfer-02 "The file handle strings MUST NOT be longer than 256 bytes."
 handle_op(Request, ReqId, <<?UINT32(HLen), _/binary>>, State = #state{xf = XF})

lib/ssh/test/ssh_sftpd_SUITE.erl

@@ -63,7 +63,8 @@
          ver3_rename/1,
          ver6_basic/1,
          write_file/1,
-         access_attributes_outside_root/1
+         access_attributes_outside_root/1,
+         extended_data_no_infinite_loop/1
         ]).
 
 -include_lib("common_test/include/ct.hrl").
@@ -127,7 +128,8 @@ all() ->
      relative_path,
      open_file_dir_v5,
      open_file_dir_v6,
-     access_attributes_outside_root].
+     access_attributes_outside_root,
+     extended_data_no_infinite_loop].
 
 groups() -> 
     [].
@@ -1025,6 +1027,17 @@ access_attributes_outside_root(Config) when is_list(Config) ->
         file:delete(OutsideRootFile)
     end.
 
+%%--------------------------------------------------------------------
+extended_data_no_infinite_loop(Config) when is_list(Config) ->
+    %% Regression test for CVE-2026-54886, sending extended data to ssh_sftpd.erl
+    %% caused an infinite loop
+    {Cm, Channel} = proplists:get_value(sftp, Config),
+    ok = ssh_connection:send(Cm, Channel, 1, <<"trigger">>),
+
+    Data = <<?UINT32(5), ?SSH_FXP_INIT, ?UINT32(6)>>,
+    ok = ssh_connection:send(Cm, Channel, Data),
+    {ok, <<?SSH_FXP_VERSION, ?UINT32(_Version), _/binary>>, _} = reply(Cm, Channel).
+
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------