Protect against crash on too small SSH_MSG_IGNORE packets.
Reported by Bob Alexander <balexander@expressor-software.com> in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>.
Этот коммит содержится в:
родитель
fc60563840
Коммит
e5f170bae2
14
src/packet.c
14
src/packet.c
@ -533,11 +533,15 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
|
||||
break;
|
||||
|
||||
case SSH_MSG_IGNORE:
|
||||
/* As with disconnect, back it up one and add a trailing NULL */
|
||||
memcpy(data + 4, data + 5, datalen - 5);
|
||||
data[datalen] = '\0';
|
||||
if (session->ssh_msg_ignore) {
|
||||
LIBSSH2_IGNORE(session, (char *) data + 4, datalen - 5);
|
||||
if (datalen >= 5) {
|
||||
/* Back it up one and add a trailing NULL */
|
||||
memmove(data, data + 1, datalen - 1);
|
||||
data[datalen] = '\0';
|
||||
if (session->ssh_msg_ignore) {
|
||||
LIBSSH2_IGNORE(session, (char *) data + 4, datalen - 1);
|
||||
}
|
||||
} else if (session->ssh_msg_ignore) {
|
||||
LIBSSH2_IGNORE(session, "", 0);
|
||||
}
|
||||
LIBSSH2_FREE(session, data);
|
||||
session->packAdd_state = libssh2_NB_state_idle;
|
||||
|
Загрузка…
Ссылка в новой задаче
Block a user