Both patches look innocuous enough. My only question is why is the public key being trimmed in the first place and will this effect the key exchange? It seems a less invasive fix would be to check pubkey_len > 0 before decrementing the length instead of removing the decrementing all together.
Will
> On Sep 25, 2015, at 1:24 AM, Salvador Fandiño <sfandino_at_gmail.com> wrote:
>
> On 09/25/2015 02:25 AM, sisyphus1-sFbbPxZDHXw0n/F98K4Iww_at_public.gmane.org wrote:
>
>> I'm having difficulty accessing the above links. (I suppose it's
>> possible if I do the requisite research.)
>>
>> Is there a way to grab the patches from the mailing list archive ?
>> The two posts are visible at:
>> http://www.libssh2.org/mail/libssh2-devel-archive-2015-08/0027.shtml
>> and
>> http://www.libssh2.org/mail/libssh2-devel-archive-2015-08/0015.shtml
>>
>> but I haven't found a way of grabbing their attachments.
>
> You can get them from the gmane archive using a web browser:
>
> http://news.gmane.org/gmane.network.ssh.libssh2.devel
>
> (though, in my opinion, the interesting thing about gmane is its mailing-list to nntp gateway service)
>
> Anyway, I am attaching the patches here again.
> <0001-Detect-bad-usage-of-libssh2_channel_process_startup.patch><0001-Fix-off-by-one-error-when-reading-public-key-file.patch>_______________________________________________
> libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
Received on 2015-09-25