[openssh-commits] [openssh] 02/02: upstream: Check for unsigned integer overflow when calculating how

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 773771be4ae241380e5f2b65059c441f7eef2da7
Author: dtucker at openbsd.org <dtucker at openbsd.org>
AuthorDate: Sun Oct 11 20:45:25 2026 +0000

    upstream: Check for unsigned integer overflow when calculating how
    
    much beyond our local window a peer has sent.  Prevents them sneaking past
    the grace we allow.
    
    bz#4031, from rhowe425 at gmail.com, ok markus@
    
    OpenBSD-Commit-ID: 51d7a8cb8338501c2a2c117945b8e728c1645ee5
---
 channels.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/channels.c b/channels.c
index abae44b92..363dc1378 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.470 2026/09/16 06:23:15 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.471 2026/10/11 20:45:25 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -3585,7 +3585,12 @@ channel_input_data(int type, uint32_t seq, struct ssh *ssh)
 		return 0;
 	}
 	if (win_len > c->local_window) {
-		c->local_window_exceeded += win_len - c->local_window;
+		u_int delta = win_len - c->local_window;
+
+		if (c->local_window_exceeded > UINT_MAX - delta)
+			c->local_window_exceeded = UINT_MAX;
+		else
+			c->local_window_exceeded += delta;
 		logit("channel %d: rcvd too much data %zu, win %u/%u "
 		    "(excess %u)", c->self, win_len, c->local_window,
 		    c->local_window_max, c->local_window_exceeded);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.