回合上游社区补丁libssh2

<h3>优先级:</h3>次要<h3>原因分析:</h3>【是否新引入rpm包，是否进行了安全编译选项扫描】是【定位分析】以下包的以下补丁需要同步：libssh2<table ><tr><td colSpan="1" rowSpan="1">软件包</td><td colSpan="1" rowSpan="1">CommitId</td><td colSpan="1" rowSpan="1">描述</td><td colSpan="1" rowSpan="1">分析人</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:libssh2</td><td colSpan="1" rowSpan="1">cea8783ed8cc0e3c8feea0e4269ca41641f00f44 </td><td colSpan="1" rowSpan="1">cea8783ed8cc0e3c8feea0e4269ca41641f00f44 Fix small leak in base64_encodeFix small memory leak when trying to encode base64 data with no data. aa4c7b5b96d3d8ba5a452e5227cf9ed71b5a8d2e Notes:Handle malformed comment in known_hosts parsing to avoid buffer overflow. 30befffe04314dfd8e6168485ae1a82dff331472 In &#x60;kex_method_diffie_hellman_group_exchange_sha256_key_exchange&#x60;,&#x60;p&#x60; and &#x60;g&#x60; are later initialized with &#x60;_libssh2_bn_from_bin&#x60;, so theyshould be initially created using &#x60;_libssh2_bn_init_from_bin&#x60; ratherthan &#x60;_libssh2_bn_init&#x60;, as is done in&#x60;kex_method_diffie_hellman_group_exchange_sha1_key_exchange&#x60;. Fixing memory leaks when using the libgcrypt backend. Follow-up to 09c5e59933daf67b833f34b8c388766abc038483Ref: https://web.archive.org/web/trac.libssh2.org/ticket/168 992dafbc7f800f8a86c0855a6ea4157bdeb1201d Notes:* Error handling if path for scp is NULL Reported-by:Liu Xing Yu d1c0e14d2a7a82de83b9085299bcb9f715c57416 Notes:Added additional base64 decoding validation when parsing known_hosts and no longer assume what is going into _libssh2_base64_encode is a null terminated C string, input now must have a length and buffer. Reported by:Dhiraj Mishra mishra.dhiraj95@gmail.com Credit:Will Cosgrove ff50682c238875ebef8601c0d6bc2105600422e8 Add bounds checking to public SFTP API input to avoid possible heap corruption when passing in invalid values. Credit: Oblivionsage 31ec5a8b55cc90efb0bd1bb2be621e416f1444ef packet: authagent_open: fix failure packet length (#1701) Compute packet_len using strlen(AuthAgentUnavail) (not X11FwdUnAvil). The mismatch could send 1 uninitialized byte on the wire. Credit: Joshua Rogers 16ce0ec89b6f171cf5f094bb41d6de80c17d98da mbedtls: fix using garbage value (reported by clang-tidy) In &#x60;_libssh2_mbedtls_pub_priv_key()&#x60; on a NON-error code path, a stack variable was checked without initializing it first. I found it interesting that clang-tidy did not find this when building against the system mbedtls (2.x) with 2.x compatibility code still in. Then it did find it when using a manual build of mbedtls 3.1.0 with 2.x compatibility code deleted from libssh2. Being such a trivial error I wonder why no compiler ever detected it as a regular warning. linux (clang-tidy, amd64, mbedTLS-prev [3.1.0], cmake, ON): &#x60;&#x60;&#x60; src/mbedtls.c:744:8: error: Branch condition evaluates to a garbage value [clang-analyzer-core.uninitialized.Branch,-warnings-as-errors] 744 | if(ret) { | ^ &#x60;&#x60;&#x60; Ref: https://github.com/libssh2/libssh2/actions/runs/18620615649/job/53091295760#step:22:44 Follow-up to 186f1a2d75560d960bc9ec0e727c14328f51ca4a #132 Cherry-picked from #1727 Closes #1729 【是否修改引入】 否 </td></tr></table>

src-openEuler/libssh2

内容风险标识

评论 (5)

src-openEuler/libssh2 .gitee-modal { width: 500px !important; }

内容风险标识