From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sun, 28 Jun 2026 02:12:52 +0200 Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit `libssh2_publickey_list_fetch()` Cap list size at 1024 elements. Reported-and-initial-patch-by: Mateusz Gierblinski Reported-and-initial-patch-by: Behzod Abdullayev Reported-by: Sharique Raza Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 Closes #2128 --- src/publickey.c | 5 +++++ 1 file changed, 5 insertions(+) Index: libssh2-1.11.1/src/publickey.c =================================================================== --- libssh2-1.11.1.orig/src/publickey.c +++ libssh2-1.11.1/src/publickey.c @@ -1121,6 +1121,11 @@ libssh2_publickey_list_fetch(LIBSSH2_PUB } if(list[keys].num_attrs) { + if(list[keys].num_attrs > 1024) { + _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY, + "Too many publickey attributes"); + goto err_exit; + } list[keys].attrs = LIBSSH2_ALLOC(session, list[keys].num_attrs *