[openssh-commits] [openssh] 62/87: upstream: sanitise some peer-provided strings that get written in

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit e3c9ed5ad472bc34d447e98ac7157dd601362556
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 07:25:33 2026 +0000

    upstream: sanitise some peer-provided strings that get written in
    
    logs via asmprintf(), e.g. `ssh -O conninfo` and `ssh -O channels`
    
    Anthropic ANT-2026-F5EYSC8G
    
    OpenBSD-Commit-ID: d7258da015683c85ce6d9ffb5843b818add5fd59
---
 channels.c | 20 ++++++++++++++++----
 mux.c      |  5 +++--
 packet.c   | 18 +++++++++++++++---
 3 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/channels.c b/channels.c
index 5953143b1..219c6a80e 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.476 2026/10/30 05:16:48 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.477 2026/10/30 07:25:33 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -78,6 +78,7 @@
 #include "canohost.h"
 #include "pathnames.h"
 #include "match.h"
+#include "utf8.h"
 
 /* XXX remove once we're satisfied there's no lurking bugs */
 /* #define DEBUG_CHANNEL_POLL 1 */
@@ -1149,8 +1150,8 @@ channel_open_message(struct ssh *ssh)
 	struct sshbuf *buf;
 	Channel *c;
 	u_int i;
-	int r;
-	char *cp, *ret;
+	int r, w;
+	char *cp, *name, *ret;
 
 	if ((buf = sshbuf_new()) == NULL)
 		fatal_f("sshbuf_new");
@@ -1183,12 +1184,23 @@ channel_open_message(struct ssh *ssh)
 		case SSH_CHANNEL_X11_OPEN:
 		case SSH_CHANNEL_MUX_PROXY:
 		case SSH_CHANNEL_MUX_CLIENT:
+			/*
+			 * The remote name may have been supplied by the
+			 * peer; don't let embedded newlines or control
+			 * characters mess up the display.
+			 */
+			w = INT_MAX;
+			asmprintf(&name, INT_MAX, &w, "%s", c->remote_name);
+			if (name == NULL)
+				fatal_f("asmprintf failed");
 			cp = channel_format_status(c);
 			if ((r = sshbuf_putf(buf, "  #%d %.300s (%s)\r\n",
-			    c->self, c->remote_name, cp)) != 0) {
+			    c->self, name, cp)) != 0) {
+				free(name);
 				free(cp);
 				fatal_fr(r, "sshbuf_putf");
 			}
+			free(name);
 			free(cp);
 			continue;
 		default:
diff --git a/mux.c b/mux.c
index e77493823..23376c861 100644
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.116 2026/09/23 21:42:39 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.117 2026/10/30 07:25:33 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm at openbsd.org>
  *
@@ -49,6 +49,7 @@
 #include "sshpty.h"
 #include "readconf.h"
 #include "clientloop.h"
+#include "utf8.h"
 
 /* from ssh.c */
 extern int tty_flag;
@@ -2450,7 +2451,7 @@ muxclient(const char *path)
 		    "connection" : "channels");
 		if (info == NULL)
 			fatal_f("info request failed");
-		printf("%s", info);
+		mprintf("%s", info);
 		exit(0);
 	case SSHMUX_COMMAND_TERMINATE:
 		mux_client_request_terminate(sock);
diff --git a/packet.c b/packet.c
index bf556c680..82e891e1d 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.348 2026/10/30 05:21:48 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.349 2026/10/30 07:25:33 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -88,6 +88,7 @@
 #include "ssherr.h"
 #include "sshbuf.h"
 #include "version.h"
+#include "utf8.h"
 
 #ifdef PACKET_DEBUG
 #define DBG(x) x
@@ -3094,8 +3095,9 @@ connection_info_message(struct ssh *ssh)
 	struct kex *kex;
 	struct session_state *state;
 	struct newkeys *nk_in, *nk_out;
-	char *stats_in = NULL, *stats_out = NULL;
+	char *stats_in = NULL, *stats_out = NULL, *remote_version = NULL;
 	uint64_t epoch = (uint64_t)time(NULL) - monotime();
+	int w;
 
 	if (ssh == NULL)
 		return NULL;
@@ -3150,6 +3152,15 @@ connection_info_message(struct ssh *ssh)
 	}
 	comp_info = comp_status_message(ssh);
 
+	/*
+	 * The remote version string was supplied by the peer; don't let
+	 * control characters in it mess up the display.
+	 */
+	w = INT_MAX;
+	asmprintf(&remote_version, INT_MAX, &w, "%s", ssh->remote_version);
+	if (remote_version == NULL)
+		fatal_f("asmprintf failed");
+
 	xasprintf(&ret, "Connection information for %s pid %lld\r\n"
 	    "  versions %s -> %s\r\n"
 	    "%s"
@@ -3160,7 +3171,7 @@ connection_info_message(struct ssh *ssh)
 	    "  traffic %s in, %s out\r\n"
 	    "%s",
 	    thishost, (long long)getpid(),
-	    SSH_RELEASE, ssh->remote_version,
+	    SSH_RELEASE, remote_version,
 	    tcp_info,
 	    fmt_timeframe(monotime() - state->start_time),
 	    kex->name, kex->hostkey_alg,
@@ -3178,6 +3189,7 @@ connection_info_message(struct ssh *ssh)
 	free(rekey_volume);
 	free(rekey_time);
 	free(comp_info);
+	free(remote_version);
 	return ret;
 }
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.