[libssh2/f16] avoid a crash of curl when downloading large files using SFTP (#802382)
Kamil Dudka
kdudka at fedoraproject.org
Mon Mar 12 12:52:17 UTC 2012
commit d77a1af0b751eab873d714d07eff7b0c55f9b100
Author: Kamil Dudka <kdudka at redhat.com>
Date: Mon Mar 12 13:50:31 2012 +0100
avoid a crash of curl when downloading large files using SFTP (#802382)
libssh2-1.2.7-bz802382.patch | 32 ++++++++++++++++++++++++++++++++
libssh2.spec | 9 ++++++++-
2 files changed, 40 insertions(+), 1 deletions(-)
---
diff --git a/libssh2-1.2.7-bz802382.patch b/libssh2-1.2.7-bz802382.patch
new file mode 100644
index 0000000..11b7bb2
--- /dev/null
+++ b/libssh2-1.2.7-bz802382.patch
@@ -0,0 +1,32 @@
+From be86f37814a3f80bb1e827be1e08e608d8f304f4 Mon Sep 17 00:00:00 2001
+From: Joey Degges <jdegges at gmail.com>
+Date: Tue, 21 Dec 2010 02:53:20 -0800
+Subject: [PATCH] _libssh2_ntohu64: fix conversion from network bytes to uint64
+
+Cast individual bytes to uint64 to avoid overflow in arithmetic.
+
+Signed-off-by: Kamil Dudka <kdudka at redhat.com>
+---
+ src/misc.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/misc.c b/src/misc.c
+index e6c5e99..a5e540c 100644
+--- a/src/misc.c
++++ b/src/misc.c
+@@ -148,8 +148,10 @@ _libssh2_ntohu64(const unsigned char *buf)
+ {
+ unsigned long msl, lsl;
+
+- msl = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
+- lsl = (buf[4] << 24) | (buf[5] << 16) | (buf[6] << 8) | buf[7];
++ msl = ((libssh2_uint64_t)buf[0] << 24) | ((libssh2_uint64_t)buf[1] << 16)
++ | ((libssh2_uint64_t)buf[2] << 8) | (libssh2_uint64_t)buf[3];
++ lsl = ((libssh2_uint64_t)buf[4] << 24) | ((libssh2_uint64_t)buf[5] << 16)
++ | ((libssh2_uint64_t)buf[6] << 8) | (libssh2_uint64_t)buf[7];
+
+ return ((libssh2_uint64_t)msl <<32) | lsl;
+ }
+--
+1.7.1
+
diff --git a/libssh2.spec b/libssh2.spec
index 4e102d5..90d172e 100644
--- a/libssh2.spec
+++ b/libssh2.spec
@@ -1,12 +1,13 @@
Name: libssh2
Version: 1.2.7
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: A library implementing the SSH2 protocol
Group: System Environment/Libraries
License: BSD
URL: http://www.libssh2.org
Source0: http://libssh2.org/download/libssh2-%{version}.tar.gz
+Patch0: libssh2-1.2.7-bz802382.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: openssl-devel
@@ -45,6 +46,9 @@ developing applications that use %{name}.
%prep
%setup -q
+# avoid a crash of curl when downloading large files using SFTP (#802382)
+%patch0 -p1
+
# make sure things are UTF-8...
for i in ChangeLog NEWS ; do
iconv --from=ISO-8859-1 --to=UTF-8 $i > new
@@ -112,6 +116,9 @@ rm -rf %{buildroot}
%{_libdir}/pkgconfig/*
%changelog
+* Mon Mar 12 2012 Kamil Dudka <kdudka at redhat.com> 1.2.7-3
+- avoid a crash of curl when downloading large files using SFTP (#802382)
+
* Sat Jun 25 2011 Dennis Gilmore <dennis at ausil.us> - 1.2.7-2
- sshd/loopback test fails in the sparc buildsystem
More information about the scm-commits
mailing list