WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fix integer underflow in SFTP RecvRead bound check 

- Replace `strSz > maxSz - WOLFSSH_SFTP_HEADER - idx`
  with `strSz > WOLFSSH_MAX_SFTP_RW` to prevent unsigned
  wraparound and downstream WMALLOC size overflow.
- Apply to both POSIX and Windows variants.

Issue: F-3682
pull/972/head
John Safranek 2026-05-11 11:56:09 -07:00 committed by Paul Adelsbach
parent 8231703875
commit 6e6995980e
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wolfsftp.c
View File

@ -3835,7 +3835,8 @@ int wolfSSH_SFTP_RecvRead(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
if (GetUint32(&strSz, data, maxSz, &idx) != WS_SUCCESS) {
return WS_BUFFER_E;
}
if (strSz > maxSz - WOLFSSH_SFTP_HEADER - idx) {
/* Bound strSz to the maximum SFTP read/write payload size. */
if (strSz > WOLFSSH_MAX_SFTP_RW) {
return WS_BUFFER_E;
}
@ -3942,7 +3943,8 @@ int wolfSSH_SFTP_RecvRead(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
if (GetUint32(&strSz, data, maxSz, &idx) != WS_SUCCESS) {
return WS_BUFFER_E;
}
if (strSz > maxSz - WOLFSSH_SFTP_HEADER - idx) {
/* Bound strSz to the maximum SFTP read/write payload size. */
if (strSz > WOLFSSH_MAX_SFTP_RW) {
return WS_BUFFER_E;
}