From 77bc71f4ca2949a11110092034dd0705faa6d7b5 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Tue, 19 Mar 2019 13:43:34 +0100
Subject: [PATCH] Resolves: CVE-2019-3861 - fix out-of-bounds reads with
 specially crafted SSH packets

Upstream-Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3861.patch
---
 src/transport.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/transport.c b/src/transport.c
index 5349284..6224c4f 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -442,6 +442,9 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
             }
 
             p->padding_length = block[4];
+            if ( p->padding_length > p->packet_length - 1 ) {
+                return LIBSSH2_ERROR_DECRYPT;
+            }
 
             /* total_num is the number of bytes following the initial
                (5 bytes) packet length and padding length fields */
-- 
2.17.2