[Bug 4028] New: sshd missing sentinel in TCPKeepAlive option table causes out-of-bounds reads

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4028

            Bug ID: 4028
           Summary: sshd missing sentinel in TCPKeepAlive option table
                    causes out-of-bounds reads
           Product: Portable OpenSSH
           Version: 10.6p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: dambi at tio.cz

The multistate_keepalives[] table in servconf.c is missing its { NULL,
-1 } terminator. The parse_multistate loop depends on this sentinel
and reads past the end of the array when TCPKeepAlive is given an
unrecognized value.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.