sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
⎇ 08fdec3bbfb0b812d91f80c84e96e04f5332a29c
tandas/staged-2026-06-26/CVE-2026-55200.patch
History
raw
Etapa G: fuel-5 — recarga la cola del VPS (parado 14h sin producir)
1From 63e27b6855f2d8484379ad4b128680561b84e957 Mon Sep 17 00:00:00 2001
2From: Will Cosgrove <will@panic.com>
3Date: Fri, 12 Jun 2026 15:57:44 -0700
4Subject: [PATCH] transport.c: Additional boundary checks for packet length
5 (#2052)
6
7Add additional bounds checking on packet length to prevent OOB write.
8
9Credit: [TristanInSec](https://github.com/TristanInSec)
10
11Cherry-picked from 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8.
12Co-authored-by: LN Liberda <lauren@selfisekai.rocks>
13---
14 src/transport.c | 6 +++++-
15 1 file changed, 5 insertions(+), 1 deletion(-)
16
17diff --git a/src/transport.c b/src/transport.c
18index e1120656..d147505b 100644
19--- a/src/transport.c
20+++ b/src/transport.c
21@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
22 total_num = 4;
23
24 p->packet_length = _libssh2_ntohu32(block);
25- if(p->packet_length < 1)
26+ if(p->packet_length < 1) {
27 return LIBSSH2_ERROR_DECRYPT;
28+ }
29+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
30+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
31+ }
32
33 /* total_num may include size field, however due to existing
34 * logic it needs to be removed after the entire packet is read