From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sat, 4 Jul 2026 11:19:49 +0200 Subject: [PATCH] publickey: fix potential OOB read in `libssh2_publickey_list_fetch()` Reported-by: Vladimir Eli Tokarev Fixes GHSA-w6g9-cpfp-22gc Closes #2202 --- src/publickey.c | 7 +++++++ 1 file changed, 7 insertions(+) Index: libssh2-1.11.1/src/publickey.c =================================================================== --- libssh2-1.11.1.orig/src/publickey.c +++ libssh2-1.11.1/src/publickey.c @@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUB } if(comment_len) { + if(pkey->listFetch_s + comment_len > + pkey->listFetch_data + pkey->listFetch_data_len) { + _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, + "ListFetch data too short"); + goto err_exit; + } + list[keys].num_attrs = 1; list[keys].attrs = LIBSSH2_ALLOC(session,