From cbf0d9a76c4ebfed1d3f41aeb259b9f012dc97b5 Mon Sep 17 00:00:00 2001 From: Thomas Wolf Date: Sat, 1 Oct 2022 20:44:59 +0200 Subject: [PATCH] [sshd] Guard against numerical overflow Check the key length before adding; the addition might overflow. Change-Id: Icde7c92a5bb267fdd869d5a1c0842967ab1a7fd9 Signed-off-by: Thomas Wolf --- .../jgit/internal/transport/sshd/agent/SshAgentClient.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/agent/SshAgentClient.java b/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/agent/SshAgentClient.java index cbcb4d240..4969414c5 100644 --- a/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/agent/SshAgentClient.java +++ b/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/agent/SshAgentClient.java @@ -427,14 +427,14 @@ private static byte[] asn1Parse(byte[] encoded, int n) throws IOException { private static PublicKey readKey(Buffer buffer) throws BufferException { int endOfBuffer = buffer.wpos(); int keyLength = buffer.getInt(); - int afterKey = buffer.rpos() + keyLength; - if (keyLength <= 0 || afterKey > endOfBuffer) { + if (keyLength <= 0 || keyLength > buffer.available()) { throw new BufferException( MessageFormat.format(SshdText.get().sshAgentWrongKeyLength, Integer.toString(keyLength), Integer.toString(buffer.rpos()), Integer.toString(endOfBuffer))); } + int afterKey = buffer.rpos() + keyLength; // Limit subsequent reads to the public key blob buffer.wpos(afterKey); try {