WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

wolfSSH_DoControlSeq: tighten escBuf bounds 

- Guard escBuf[i] read when getArgs consumes all input without a command.
- Cap WMEMCPY against WOLFSSL_MAX_ESCBUF; escBufSz can exceed 16.
- Update escBufSz on WS_WANT_READ resume so CSI leftovers survive
  multi-fill reads.

Issue: F-250
pull/990/head
John Safranek 2026-05-14 13:55:44 -07:00 committed by Paul Adelsbach
parent 1aac6d2f5a
commit 80c3a0e61a
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/wolfterm.c
View File

@ -424,11 +424,21 @@ static int wolfSSH_DoControlSeq(WOLFSSH* ssh, WOLFSSH_HANDLE handle, byte* buf,
if (ssh->escState == WS_ESC_CSI || ssh->escBufSz > 0) {
/* check for left overs */
if (ssh->escBufSz > 0) {
word32 tmpSz = min(bufSz - *idx,
WOLFSSH_MAX_CONSOLE_ARGS - (word32)ssh->escBufSz);
word32 tmpSz;
if (ssh->escBufSz >= WOLFSSL_MAX_ESCBUF) {
WLOG(WS_LOG_ERROR, "escBuf state exceeds capacity");
return WS_FATAL_ERROR;
}
tmpSz = min(bufSz - *idx,
(word32)WOLFSSL_MAX_ESCBUF - (word32)ssh->escBufSz);
WMEMCPY(ssh->escBuf + ssh->escBufSz, buf + *idx, tmpSz);
i = 0;
numArgs = getArgs(ssh->escBuf, ssh->escBufSz + tmpSz, &i, args);
if (i >= ssh->escBufSz + tmpSz) {
ssh->escBufSz += tmpSz;
return WS_WANT_READ;
}
c = ssh->escBuf[i++];
if (!isCommand(c)) {
/* expecting a command when in CSI state */