[libssh2] #267: file_read_publickey access violation

#267: file_read_publickey access violation
-------------------------------------------------+-------------------------
 Reporter: wimvdh | Owner:
     Type: defect | Status: new
 Priority: blocker | Milestone: 1.4.3
Component: SFTP | Version: 1.4.2
 Keywords: file_read_publickey access | Blocked By:
  violation sp1 crash |
   Blocks: |
-------------------------------------------------+-------------------------
 file_read_publickey:

 {{{
     if ((sp1 = memchr(pubkey, ' ', pubkey_len)) == NULL) {
         LIBSSH2_FREE(session, pubkey);
         return _libssh2_error(session, LIBSSH2_ERROR_FILE,
                               "Invalid public key data");
     }

     sp1++;

     if ((sp2 = memchr(sp1, ' ', pubkey_len - (sp1 - pubkey - 1))) == NULL)
 {
         /* Assume that the id string is missing, but that it's okay */
         sp2 = pubkey + pubkey_len;
     }

 }}}

 The memchr sometimes gives an access violation when the last char in
 pubkey is at the end of the memory block.
 Problem here is that sp1 already points to the char after the space, which
 means "pubkey_len - (sp1 - pubkey - 1)" gives a length which goes 1 past
 the length of the buffer.

 Example:
 Key is 208 long. (pubkey_len)
 Space is at position 7. (sp1)
 Increment by one is position 8 (sp1++)
 208 - (8 - 0 - 1) = 201.
 Reading 201 while there are only 200 chars left to read.

-- 
Ticket URL: <https://trac.libssh2.org/ticket/267>
libssh2 <https://trac.libssh2.org/>
C library for writing portable SSH2 clients
_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel