mirrors/openssh
0
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-11-23 01:03:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

upstream: require control-escape character sequences passed via the '-e

Browse Source 
^x' commandline to be exactly two characters long. Avoids one by OOB read if
ssh is invoked as "ssh -e^ ..."

Spotted by Maciej Domanski in GHPR368

OpenBSD-Commit-ID: baa72bc60898fc5639e6c62de7493a202c95823d
This commit is contained in:
djm@openbsd.org 2024-10-18 05:03:34 +00:00 committed by Damien Miller
parent 74ff6382f5
commit d01ee7a88c
No known key found for this signature in database
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ssh.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh.c,v 1.600 2024/01/11 01:45:36 djm Exp $ */
/* $OpenBSD: ssh.c,v 1.601 2024/10/18 05:03:34 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -965,7 +965,7 @@ main(int ac, char **av)
options.log_level = SYSLOG_LEVEL_QUIET;
break;
case 'e':
if (optarg[0] == '^' && optarg[2] == 0 &&
if (strlen(optarg) == 2 && optarg[0] == '^' &&
(u_char) optarg[1] >= 64 &&
(u_char) optarg[1] < 128)
options.escape_char = (u_char) optarg[1] & 31;