File libssh2_org-CVE-2020-22218.patch of Package libssh2_org.30346

Overview Repositories Revisions Requests Users Attributes Meta

File libssh2_org-CVE-2020-22218.patch of Package libssh2_org.30346

From 642eec48ff3adfdb7a9e562b6d7fc865d1733f45 Mon Sep 17 00:00:00 2001
From: lutianxiong <lutianxiong@huawei.com>
Date: Fri, 29 May 2020 01:25:40 +0800
Subject: [PATCH] transport.c: fix use-of-uninitialized-value (#476)

file:transport.c

notes:
return error if malloc(0)

credit:
lutianxiong
---
 src/transport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/transport.c b/src/transport.c
index 96fca6b8cc..adf96c2437 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -472,7 +472,7 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
             /* Get a packet handle put data into. We get one to
                hold all data, including padding and MAC. */
             p->payload = LIBSSH2_ALLOC(session, total_num);
-            if(!p->payload) {
+            if(total_num == 0 || !p->payload) {
                 return LIBSSH2_ERROR_ALLOC;
             }
             p->total_num = total_num;
From 0b44e558f311671f6e6d14c559bc1c9bda59b8df Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Thu, 28 May 2020 14:20:08 -0700
Subject: [PATCH] transport.c: moving total_num check from #476 (#478)

file: transport.c

notes:
moving total_num zero length check from #476 up to the prior bounds check which already includes a total_num check. Makes it slightly more readable.

credit:
Will Cosgrove
---
 src/transport.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/transport.c b/src/transport.c
index adf96c2437..11e56142f4 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -465,14 +465,14 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
              * or less (including length, padding length, payload,
              * padding, and MAC.)."
              */
-            if(total_num > LIBSSH2_PACKET_MAXPAYLOAD) {
+            if(total_num > LIBSSH2_PACKET_MAXPAYLOAD || total_num == 0) {
                 return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
             }
 
             /* Get a packet handle put data into. We get one to
                hold all data, including padding and MAC. */
             p->payload = LIBSSH2_ALLOC(session, total_num);
-            if(total_num == 0 || !p->payload) {
+            if(!p->payload) {
                 return LIBSSH2_ERROR_ALLOC;
             }
             p->total_num = total_num;

Places

File libssh2_org-CVE-2020-22218.patch of Package libssh2_org.30346

Places