From e31f06e5380be4e714d5ad6965981fbf30738da9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
Date: Fri, 6 Mar 2026 18:05:29 +0100
Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len
 in SSH_FXP_READ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The client-provided length is directly used in
a malloc in process_read(), so not restricting it
leads to allocations bounded only by UINT32_MAX.

The new cap is the same as the one currently used
by OpenSSH.

Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)

Index: libssh-0.10.6/src/sftpserver.c
===================================================================
--- libssh-0.10.6.orig/src/sftpserver.c
+++ libssh-0.10.6/src/sftpserver.c
@@ -105,6 +105,14 @@ sftp_client_message sftp_get_client_mess
         sftp_client_message_free(msg);
         return NULL;
       }
+      if (msg->len > MAX_PACKET_LEN - 1024) {
+        ssh_set_error(sftp->session,
+                      SSH_FATAL,
+                      "Too large SSH_FXP_READ length: %" PRIu32,
+                      msg->len);
+        sftp_client_message_free(msg);
+	return NULL;
+      }
       break;
     case SSH_FXP_WRITE:
       rc = ssh_buffer_unpack(payload,