generic-library/ssh2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Protect against crash on too small SSH_MSG_IGNORE packets.

Browse Source 
Reported by Bob Alexander <balexander@expressor-software.com>
in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>.
This commit is contained in:
Simon Josefsson
2009-10-28 15:27:11 +01:00
parent fc60563840
commit e5f170bae2
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/packet.c
View File

@@ -533,11 +533,15 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
break; break;
case SSH_MSG_IGNORE: case SSH_MSG_IGNORE:
/* As with disconnect, back it up one and add a trailing NULL */ if (datalen >= 5) {
memcpy(data + 4, data + 5, datalen - 5); /* Back it up one and add a trailing NULL */
data[datalen] = '\0'; memmove(data, data + 1, datalen - 1);
if (session->ssh_msg_ignore) { data[datalen] = '\0';
LIBSSH2_IGNORE(session, (char *) data + 4, datalen - 5); if (session->ssh_msg_ignore) {
LIBSSH2_IGNORE(session, (char *) data + 4, datalen - 1);
}
} else if (session->ssh_msg_ignore) {
LIBSSH2_IGNORE(session, "", 0);
} }
LIBSSH2_FREE(session, data); LIBSSH2_FREE(session, data);
session->packAdd_state = libssh2_NB_state_idle; session->packAdd_state = libssh2_NB_state_idle;