WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

DoUserAuthRequestPassword Missing Bounds Check 

Replace the original message parsing functions with the GetStringRef()
function, which does better bounds checking.

Affected function: DoUserAuthRequestPassword.
Issue: F-411
pull/892/head
John Safranek 2026-03-09 11:10:29 -07:00
parent a8ad9f0197
commit 9cb60cdadf
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/internal.c
View File

@ -6890,20 +6890,14 @@ static int DoUserAuthRequestPassword(WOLFSSH* ssh, WS_UserAuthData* authData,
}
if (ret == WS_SUCCESS)
ret = GetUint32(&pw->passwordSz, buf, len, &begin);
ret = GetStringRef(&pw->passwordSz, &pw->password, buf, len, &begin);
if (ret == WS_SUCCESS) {
pw->password = buf + begin;
begin += pw->passwordSz;
if (pw->hasNewPassword) {
/* Skip the password change. Maybe error out since we aren't
* supporting password changes at this time. */
ret = GetUint32(&pw->newPasswordSz, buf, len, &begin);
if (ret == WS_SUCCESS) {
pw->newPassword = buf + begin;
begin += pw->newPasswordSz;
}
ret = GetStringRef(&pw->newPasswordSz, &pw->newPassword,
buf, len, &begin);
}
else {
pw->newPassword = NULL;