From 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Mon Sep 17 00:00:00 2001 From: Will Cosgrove Date: Fri, 12 Jun 2026 15:57:44 -0700 Subject: [PATCH] transport.c: Additional boundary checks for packet length (#2052) Add additional bounds checking on packet length to prevent OOB write. Credit: [TristanInSec](https://github.com/TristanInSec) --- src/transport.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) Index: libssh2-1.11.1/src/transport.c =================================================================== --- libssh2-1.11.1.orig/src/transport.c +++ libssh2-1.11.1/src/transport.c @@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESS total_num = 4; p->packet_length = _libssh2_ntohu32(block); - if(p->packet_length < 1) + if(p->packet_length < 1) { return LIBSSH2_ERROR_DECRYPT; + } + else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) { + return LIBSSH2_ERROR_OUT_OF_BOUNDARY; + } /* total_num may include size field, however due to existing * logic it needs to be removed after the entire packet is read