[openssh-commits] [openssh] 02/02: upstream: test malformed SOCKS5 messages; patch from Karl Mehltretter

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 538af298ad032d8230c25822f9e1744c667c1ff3
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Oct 27 22:53:11 2026 +0000

    upstream: test malformed SOCKS5 messages; patch from Karl Mehltretter
    
    via bz4034
    
    OpenBSD-Regress-ID: 8d1971ef2667d51a4621ae310b87ba4882a6b07c
---
 regress/dynamic-forward.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
index 6cc47e760..948191338 100644
--- a/regress/dynamic-forward.sh
+++ b/regress/dynamic-forward.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: dynamic-forward.sh,v 1.18 2025/05/21 08:41:52 djm Exp $
+#	$OpenBSD: dynamic-forward.sh,v 1.19 2026/10/27 22:53:11 djm Exp $
 #	Placed in the Public Domain.
 
 tid="dynamic forwarding"
@@ -74,6 +74,18 @@ check_socks() {
 	done
 }
 
+check_socks_malformed() {
+	direction=$1
+	# SOCKS5 auth and a bad request in a single write; bz#4034
+	trace "testing malformed socks5 request (-$direction)"
+	printf '\005\001\000\377' | \
+	    $OBJ/netcat -w 5 127.0.0.1 $FWDPORT >/dev/null 2>&1
+	if ! ${REAL_SSH} -qF$OBJ/ssh_config -O check \
+	     -oControlPath=$CTL somehost >/dev/null 2>&1 ; then
+		fatal "forwarding ssh process died on malformed request"
+	fi
+}
+
 start_sshd
 trap "stop_ssh" EXIT
 
@@ -81,6 +93,7 @@ for d in D R; do
 	verbose "test -$d forwarding"
 	start_ssh $d
 	check_socks $d Y
+	check_socks_malformed $d
 	stop_ssh
 	test "x$d" = "xR" || continue
 	

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.