mirror of https://github.com/wolfSSL/wolfssh.git
eb3d3cedb8
SFTP_GetHeader now takes a limit from its caller and refuses a declared body over it, or one too short to hold the header, with WS_BUFFER_E. Every client reply handler allocated a buffer of the peer-declared size first, so one 9-byte header could make the client allocate 2 GiB. - STATUS, ATTRS and HANDLE replies are held to WOLFSSH_MAX_SFTP_PACKET - NAME keeps WOLFSSH_MAX_SFTP_NAME; DoName's own check moves into the call - a READ reply may also be as large as the caller's buffer plus its length prefix - SendWritePacket keeps an error already set instead of WS_SFTP_BAD_HEADER - regress test drives all eleven client calls at and past the bound Issue: F-10598, F-13430, F-14433 |
||
|---|---|---|
| .. | ||
| api.c | ||
| api.h | ||
| auth.c | ||
| auth.h | ||
| include.am | ||
| kex.c | ||
| kex.h | ||
| regress.c | ||
| sftp.c | ||
| sftp.h | ||
| testsuite.c | ||
| testsuite.h | ||
| unit.c | ||
| unit.h | ||