Andrew Tridgell 359e539a72 reject negative token values in compressed stream receivers ...

Validate that token numbers read from compressed streams are
non-negative. A negative token value would cause the return value
of recv_*_token() to become positive, which callers interpret as
literal data length, but no data pointer is set on this code path.

While this only causes the receiver to crash (which is process-isolated
and only affects the attacker's own connection), it's still undefined
behavior.

Reported-by: Will Sergeant <wlsergeant@gmail.com>

2025-12-31 09:31:52 +11:00

27 KiB

Raw Blame History

View Raw