From 642eec48ff3adfdb7a9e562b6d7fc865d1733f45 Mon Sep 17 00:00:00 2001 From: lutianxiong Date: Fri, 29 May 2020 01:25:40 +0800 Subject: [PATCH] transport.c: fix use-of-uninitialized-value (#476) file:transport.c notes: return error if malloc(0) credit: lutianxiong Bug: https://github.com/libssh2/libssh2/pull/476 Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45 & https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df] CVE: CVE-2020-22218 Signed-off-by: Vijay Anusuri --- src/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/transport.c b/src/transport.c index 45e445c..35e7df3 100644 --- a/src/transport.c +++ b/src/transport.c @@ -465,7 +465,7 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session) * or less (including length, padding length, payload, * padding, and MAC.)." */ - if(total_num > LIBSSH2_PACKET_MAXPAYLOAD) { + if(total_num > LIBSSH2_PACKET_MAXPAYLOAD || total_num == 0) { return LIBSSH2_ERROR_OUT_OF_BOUNDARY; } -- 2.25.1