|
 |
acf016 |
diff -up libssh-0.9.4/src/buffer.c.fix-cve-2020-16135 libssh-0.9.4/src/buffer.c
|
|
|
acf016 |
--- libssh-0.9.4/src/buffer.c.fix-cve-2020-16135 2021-04-21 10:27:53.562473773 +0200
|
|
|
acf016 |
+++ libssh-0.9.4/src/buffer.c 2021-04-21 10:29:21.768165663 +0200
|
|
|
acf016 |
@@ -299,6 +299,10 @@ int ssh_buffer_reinit(struct ssh_buffer_
|
|
|
acf016 |
*/
|
|
|
acf016 |
int ssh_buffer_add_data(struct ssh_buffer_struct *buffer, const void *data, uint32_t len)
|
|
|
acf016 |
{
|
|
|
acf016 |
+ if (buffer == NULL) {
|
|
|
acf016 |
+ return -1;
|
|
|
acf016 |
+ }
|
|
|
acf016 |
+
|
|
|
acf016 |
buffer_verify(buffer);
|
|
|
acf016 |
|
|
|
acf016 |
if (data == NULL) {
|
|
|
acf016 |
diff -up libssh-0.9.4/src/sftpserver.c.fix-cve-2020-16135 libssh-0.9.4/src/sftpserver.c
|
|
|
acf016 |
--- libssh-0.9.4/src/sftpserver.c.fix-cve-2020-16135 2021-04-21 10:30:43.864796642 +0200
|
|
|
acf016 |
+++ libssh-0.9.4/src/sftpserver.c 2021-04-21 10:41:52.166933113 +0200
|
|
|
acf016 |
@@ -67,9 +67,20 @@ sftp_client_message sftp_get_client_mess
|
|
|
acf016 |
|
|
|
acf016 |
/* take a copy of the whole packet */
|
|
|
acf016 |
msg->complete_message = ssh_buffer_new();
|
|
|
acf016 |
- ssh_buffer_add_data(msg->complete_message,
|
|
|
acf016 |
- ssh_buffer_get(payload),
|
|
|
acf016 |
- ssh_buffer_get_len(payload));
|
|
|
acf016 |
+ if (msg->complete_message == NULL) {
|
|
|
acf016 |
+ ssh_set_error_oom(session);
|
|
|
acf016 |
+ sftp_client_message_free(msg);
|
|
|
acf016 |
+ return NULL;
|
|
|
acf016 |
+ }
|
|
|
acf016 |
+
|
|
|
acf016 |
+ rc = ssh_buffer_add_data(msg->complete_message,
|
|
|
acf016 |
+ ssh_buffer_get(payload),
|
|
|
acf016 |
+ ssh_buffer_get_len(payload));
|
|
|
acf016 |
+ if (rc < 0) {
|
|
|
acf016 |
+ ssh_set_error_oom(session);
|
|
|
acf016 |
+ sftp_client_message_free(msg);
|
|
|
acf016 |
+ return NULL;
|
|
|
acf016 |
+ }
|
|
|
acf016 |
|
|
|
acf016 |
ssh_buffer_get_u32(payload, &msg->id);
|
|
|
acf016 |
|