package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 3 Jul 2026 18:22:55 +0200
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt

Reported-by: Vladimir Eli Tokarev
Fixes GHSA-6c79-444r-wx26

Closes #2198
Forwarded: not-needed

CVE: CVE-2026-66035
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66035.patch/
Upstream: https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
---
 src/transport.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/src/transport.c
+++ b/src/transport.c
@@ -242,6 +242,12 @@
                 unsigned char *decrypt_buffer;
                 int blocksize = session->remote.crypt->blocksize;

+                if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+                    LIBSSH2_FREE(session, p->payload);
+                    return LIBSSH2_ERROR_DECRYPT;
+                }
+                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
                 rc = decrypt(session, p->payload + 4,
                              first_block, blocksize, FIRST_BLOCK);
                 if(rc) {
@@ -249,7 +255,6 @@
                 }

                 /* we need buffer for decrypt */
-                decrypt_size = p->total_num - mac_len - 4;
                 decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
                 if(!decrypt_buffer) {
                     return LIBSSH2_ERROR_ALLOC;