sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
Etapa G: fuel-4 — buffer de cola para el VPS tras recuperar conexión
1From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
2From: Will Cosgrove <will@panic.com>
3Date: Mon, 13 Apr 2026 11:18:25 -0700
4Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
5
6Return errors when username_len will exceed bounds, fix existing bounds
7check.
8
9Credit:
10[dapickle](https://github.com/dapickle)
11---
12 src/userauth.c | 13 ++++++++++++-
13 1 file changed, 12 insertions(+), 1 deletion(-)
14
15diff --git a/src/userauth.c b/src/userauth.c
16index f8e02651c4..43d9ab9b9d 100644
17--- a/src/userauth.c
18+++ b/src/userauth.c
19@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
20 memset(&session->userauth_list_packet_requirev_state, 0,
21 sizeof(session->userauth_list_packet_requirev_state));
22
23+ if(username_len > UINT32_MAX - 27) {
24+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
25+ "username_len out of bounds");
26+ return NULL;
27+ }
28+
29 session->userauth_list_data_len = username_len + 27;
30
31 if(session->userauth_list_data) {
32@@ -316,6 +322,11 @@ userauth_password(LIBSSH2_SESSION *session,
33 * 40 = packet_type(1) + username_len(4) + service_len(4) +
34 * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
35 * chgpwdbool(1) + password_len(4) */
36+ if(username_len > UINT32_MAX - 40) {
37+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
38+ "username_len out of bounds");
39+ }
40+
41 session->userauth_pswd_data_len = username_len + 40;
42
43 session->userauth_pswd_data0 =
44@@ -456,7 +467,7 @@ userauth_password(LIBSSH2_SESSION *session,
45 }
46
47 /* basic data_len + newpw_len(4) */
48- if(username_len + password_len + 44 <= UINT_MAX) {
49+ if(username_len <= UINT32_MAX - password_len - 44) {
50 session->userauth_pswd_data_len =
51 username_len + password_len + 44;
52 s = session->userauth_pswd_data =