From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 3 Jul 2026 18:22:55 +0200
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt

Reported-by: Vladimir Eli Tokarev
Fixes GHSA-6c79-444r-wx26

Closes #2198
---
 src/transport.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Index: libssh2-1.11.1/src/transport.c
===================================================================
--- libssh2-1.11.1.orig/src/transport.c
+++ libssh2-1.11.1/src/transport.c
@@ -242,6 +242,14 @@ fullpacket(LIBSSH2_SESSION * session, in
                 unsigned char *decrypt_buffer;
                 int blocksize = session->remote.crypt->blocksize;
 
+		if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+                    LIBSSH2_FREE(session, p->payload);
+                    return LIBSSH2_ERROR_DECRYPT;
+                }
+                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
+                first_block[0] = 0;
+
                 rc = decrypt(session, p->payload + 4,
                              first_block, blocksize, FIRST_BLOCK);
                 if(rc) {
@@ -249,7 +257,6 @@ fullpacket(LIBSSH2_SESSION * session, in
                 }
 
                 /* we need buffer for decrypt */
-                decrypt_size = p->total_num - mac_len - 4;
                 decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
                 if(!decrypt_buffer) {
                     return LIBSSH2_ERROR_ALLOC;