mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-04-20 23:48:20 +00:00
300be97535
Bug: https://github.com/libssh2/libssh2/pull/476 Upstream-Status: Backport [642eec48ff&0b44e558f3] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
From 642eec48ff3adfdb7a9e562b6d7fc865d1733f45 Mon Sep 17 00:00:00 2001
|
|
From: lutianxiong <lutianxiong@huawei.com>
|
|
Date: Fri, 29 May 2020 01:25:40 +0800
|
|
Subject: [PATCH] transport.c: fix use-of-uninitialized-value (#476)
|
|
|
|
file:transport.c
|
|
|
|
notes:
|
|
return error if malloc(0)
|
|
|
|
credit:
|
|
lutianxiong
|
|
|
|
Bug: https://github.com/libssh2/libssh2/pull/476
|
|
Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45
|
|
&
|
|
https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df]
|
|
CVE: CVE-2020-22218
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
src/transport.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/transport.c b/src/transport.c
|
|
index 45e445c..35e7df3 100644
|
|
--- a/src/transport.c
|
|
+++ b/src/transport.c
|
|
@@ -465,7 +465,7 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
|
|
* or less (including length, padding length, payload,
|
|
* padding, and MAC.)."
|
|
*/
|
|
- if(total_num > LIBSSH2_PACKET_MAXPAYLOAD) {
|
|
+ if(total_num > LIBSSH2_PACKET_MAXPAYLOAD || total_num == 0) {
|
|
return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
|
|
}
|
|
|
|
--
|
|
2.25.1
|
|
|