mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-26 20:10:35 -09:00
56ad2396ee
Backport the fix for CVE-2026-66032.
A SFTP error path can leave a dangling pointer after freeing the
response buffer, which may result in a double free on subsequent error
handling.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 05c13e87e9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
30 lines
986 B
Diff
30 lines
986 B
Diff
From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
|
|
From: Will Cosgrove <will@panic.com>
|
|
Date: Thu, 2 Jul 2026 11:00:23 -0700
|
|
Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
|
|
|
|
Set data to NULL after freeing it to avoid dangling pointer. fixes
|
|
GHSA-px3w-7g75-hg7w.
|
|
|
|
Credit: VladimirEliTokarev
|
|
Forwarded: not-needed
|
|
|
|
CVE: CVE-2026-66032
|
|
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66032.patch/
|
|
Upstream: https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
|
|
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
|
|
---
|
|
src/sftp.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
--- a/src/sftp.c
|
|
+++ b/src/sftp.c
|
|
@@ -1279,6 +1279,7 @@
|
|
"got HANDLE FXOK"));
|
|
|
|
LIBSSH2_FREE(session, data);
|
|
+ data = NULL;
|
|
|
|
/* silly situation, but check for a HANDLE */
|
|
rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,
|