sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
⎇ 1951f714012c646b4840cc305871623f80a65687
tandas/staged-2026-06-26/CVE-2026-55199.patch
Ñawpa willay
ch'uya
Etapa G: fuel-5 — recarga la cola del VPS (parado 14h sin producir)
1From 91360acc9f2cd3295fbeff03b448fab912426325 Mon Sep 17 00:00:00 2001
2From: TristanInSec <tristan.mtn@gmail.com>
3Date: Wed, 15 Apr 2026 14:51:08 -0400
4Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
5 handler
6
7The `SSH_MSG_EXT_INFO` handler discards the return values from
8`_libssh2_get_string()` when parsing extension name/value pairs. When
9the buffer is exhausted before all claimed extensions are parsed,
10the loop continues with no-op iterations until `nr_extensions` reaches
11zero.
12
13The `nr_extensions >= 1024` cap limits the worst case, but the loop
14should still break on parse failure for correctness and consistency
15with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
16`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
17
18Closes #1864
19---
20 src/packet.c | 6 ++++--
21 1 file changed, 4 insertions(+), 2 deletions(-)
22
23diff --git a/src/packet.c b/src/packet.c
24index 6da14e9f..ebaddae5 100644
25--- a/src/packet.c
26+++ b/src/packet.c
27@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
28
29 nr_extensions -= 1;
30
31- _libssh2_get_string(&buf, &name, &name_len);
32- _libssh2_get_string(&buf, &value, &value_len);
33+ if(_libssh2_get_string(&buf, &name, &name_len))
34+ break;
35+ if(_libssh2_get_string(&buf, &value, &value_len))
36+ break;
37
38 if(name && value) {
39 _libssh2_debug((session,