From libssh2-devel-bounces@cool.haxx.se  Tue Apr  2 01:17:22 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x31NGbkL007211;
	Tue, 2 Apr 2019 01:17:12 +0200
Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com
 [IPv6:2a00:1450:4864:20:0:0:0:42b])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x31NGZOb007182
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Tue, 2 Apr 2019 01:16:35 +0200
Received: by mail-wr1-x42b.google.com with SMTP id s15so14128875wra.12
 for <libssh2-devel@cool.haxx.se>; Mon, 01 Apr 2019 16:16:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:from:date:message-id:subject:to;
 bh=6L0TnVYWiQtPZWN/sd1gmfQ5lWtpZobNi2a3lmln/S8=;
 b=AmSh4Tx8jfTki6w1KiLdZCT5DDUA+JH1i7SkDl0+qmfOkKt1H3B7E9Z7RUv0C2vmUW
 6Hq9qqB42Jcsrg02NNDBmwXVdfLnO0CoebOTsDmoU6D+w07XPsCpDhlhbb4lVOcB3Iv8
 88YpgeQWGMpcQ5Fjsw7mf9xNhzDzA2VnJjR3lQl5GvkI5xNQw6YdOc7fjNA3XMIW+IJk
 0ijsXXm6zIgsrB8DN5t8DriXKjq99QrK7DP2sMErR7vXnOKxNp/JFKYJNm6GVTHNhumw
 6knMpR87aM6//iIreZw1kuxylLeCGPeaa/mW21nO4uir4dIRyJy4oTR5x6Co3DPFBrEg
 PQEg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
 bh=6L0TnVYWiQtPZWN/sd1gmfQ5lWtpZobNi2a3lmln/S8=;
 b=gitsAEnne3qihD+3MKS8bicpZXnnbKTFgsANmTKWSR2VkBFIVv8m82vTMxVoCmsV7+
 gSJjkUARPqwXhIn21505bXj/WCx1wnr8/R3sJSbVm3unrOPGJTtb9uHagmK8uB6CGmMC
 9YnxcOx43B3tgiB8cAcx3hWI0/729UCSspz/z4yXrlc+poV/2XZm7N/ZZLWhOsz8U25U
 gEb/HJPaf5OGVqox1lgQbbsoyGiBxRdUtz3t/7Zt8sdWuApO6xZGQDjBxu6QyREpFMUN
 gIUK1tG+Ve3mNeqSoqGP/unP8jqZg+7gsAKatnGjjcyQf++eWMQ6SS8YqnwWuoExGtyJ
 GlqA==
X-Gm-Message-State: APjAAAUKC1JnNZ5XxP3m0LEl7SAmQ5CQ4nFCDDV1HgH43fxSzhQHPin7
 gXwJz4LWIZr9o0WKy6BBzrOY7CPKyJarErHEpVZ7xshg
X-Google-Smtp-Source: APXvYqwl0fbm4QS1Xx56tnLUdYh20XiN4VIjDbjkciAdY9mVdR8NJr2/ejFV5TalMxtq2phGcO/Aa6XlprH/vN9aBkE=
X-Received: by 2002:a5d:6988:: with SMTP id g8mr608805wru.117.1554160591802;
 Mon, 01 Apr 2019 16:16:31 -0700 (PDT)
MIME-Version: 1.0
From: Mohammad Ghasemi <mghicho@gmail.com>
Date: Mon, 1 Apr 2019 16:16:20 -0700
Message-ID: <CABe46HNJKMBcAH_R=2o_rGrWngwC_kobevy+so5t7iRgRrwZ9w@mail.gmail.com>
Subject: support for ECDH key exchange algorithms?
To: libssh2-devel@cool.haxx.se
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: multipart/mixed; boundary="===============1056162579=="
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>

--===============1056162579==
Content-Type: multipart/alternative; boundary="000000000000ff955705858035b1"

--000000000000ff955705858035b1
Content-Type: text/plain; charset="UTF-8"

Is there any plan to add support for ECDH key exchange algorithms?



-- 
---
Best Regards
Mohammad Ghassemi

--000000000000ff955705858035b1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Is there any plan to add support for ECDH key exchange alg=
orithms?<div><br></div><div><br clear=3D"all"><div><br></div>-- <br><div di=
r=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div=
 dir=3D"ltr"><div><span style=3D"color:rgb(34,34,34);font-family:arial,sans=
-serif;font-size:13.333333969116211px;background-color:rgb(255,255,255)">--=
-</span><br style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-=
size:13.333333969116211px;background-color:rgb(255,255,255)"><span style=3D=
"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333333969116=
211px;background-color:rgb(255,255,255)">Best Regards</span><br style=3D"co=
lor:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333333969116211=
px;background-color:rgb(255,255,255)"><span style=3D"color:rgb(34,34,34);fo=
nt-family:arial,sans-serif;font-size:13.333333969116211px;background-color:=
rgb(255,255,255)">Mohammad Ghassemi</span><br></div></div></div></div></div=
>

--000000000000ff955705858035b1--

--===============1056162579==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--===============1056162579==--

From libssh2-devel-bounces@cool.haxx.se  Tue Apr  2 01:23:51 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x31NNbeq010278;
	Tue, 2 Apr 2019 01:23:49 +0200
Received: from mail.panic.com (mail.panic.com [38.103.165.36])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x31NNYDi010196
 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Tue, 2 Apr 2019 01:23:35 +0200
Received: from [10.0.0.249] (unknown [10.0.0.249])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mail.panic.com (Postfix) with ESMTPSA id 68F66783
 for <libssh2-devel@cool.haxx.se>; Mon,  1 Apr 2019 16:23:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=panic.com; s=dkim;
 t=1554161009; bh=FwubYVCo2xq+PtdvwejCB+e2t8jxrVhRHOGt9yxkUqM=;
 h=From:Subject:Date:References:To:In-Reply-To;
 b=b+tAD9ib0EpPbfXmqmScEteDczYLcfIkjyHsnLujtfbw7sk/3hg3ZzOTALlzbNL3/
 BayHJO2glRMkXjbSGpWTRqsp4DADEmYFfN3xwcebBwEZDWyCGpTT/zmxx0MpEKwDaz
 q1N9XzCgZsSyTIXEvHr0DbV0OySxqU/C3f8A/g8I=
From: Will Cosgrove <will@panic.com>
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\))
Subject: Re: support for ECDH key exchange algorithms?
Date: Mon, 1 Apr 2019 16:23:29 -0700
References: <CABe46HNJKMBcAH_R=2o_rGrWngwC_kobevy+so5t7iRgRrwZ9w@mail.gmail.com>
To: libssh2 development <libssh2-devel@cool.haxx.se>
In-Reply-To: <CABe46HNJKMBcAH_R=2o_rGrWngwC_kobevy+so5t7iRgRrwZ9w@mail.gmail.com>
Message-Id: <B2950AAF-0CF7-4A5B-8210-7D177DDC73B3@panic.com>
X-Mailer: Apple Mail (2.3445.104.8)
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: multipart/mixed; boundary="===============0711780009=="
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>


--===============0711780009==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_6D6786E1-F194-4AB4-8474-2258D27DD165"


--Apple-Mail=_6D6786E1-F194-4AB4-8474-2258D27DD165
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii

ECDH-sha2-* and curve 25519 are both supported on master.

Cheers,
Will

> On Apr 1, 2019, at 4:16 PM, Mohammad Ghasemi <mghicho@gmail.com> wrote:
> 
> Is there any plan to add support for ECDH key exchange algorithms?
> 
> 
> 
> -- 
> ---
> Best Regards
> Mohammad Ghassemi
> _______________________________________________
> libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel


--Apple-Mail=_6D6786E1-F194-4AB4-8474-2258D27DD165
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D"">ECDH-sha2-* and&nbsp;curve 25519 are both supported on =
master.<div class=3D""><br class=3D""></div><div =
class=3D"">Cheers,</div><div class=3D"">Will<br class=3D""><div><br =
class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Apr =
1, 2019, at 4:16 PM, Mohammad Ghasemi &lt;<a =
href=3D"mailto:mghicho@gmail.com" class=3D"">mghicho@gmail.com</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
dir=3D"ltr" class=3D"">Is there any plan to add support for ECDH key =
exchange algorithms?<div class=3D""><br class=3D""></div><div =
class=3D""><br clear=3D"all" class=3D""><div class=3D""><br =
class=3D""></div>-- <br class=3D""><div dir=3D"ltr" =
class=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div =
dir=3D"ltr" class=3D""><div class=3D""><span =
style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
333969116211px;background-color:rgb(255,255,255)" class=3D"">---</span><br=
 =
style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
333969116211px;background-color:rgb(255,255,255)" class=3D""><span =
style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
333969116211px;background-color:rgb(255,255,255)" class=3D"">Best =
Regards</span><br =
style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
333969116211px;background-color:rgb(255,255,255)" class=3D""><span =
style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
333969116211px;background-color:rgb(255,255,255)" class=3D"">Mohammad =
Ghassemi</span><br class=3D""></div></div></div></div></div>
_______________________________________________<br =
class=3D"">libssh2-devel <a =
href=3D"https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel" =
class=3D"">https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel</a>=
<br class=3D""></div></blockquote></div><br =
class=3D""></div></body></html>=

--Apple-Mail=_6D6786E1-F194-4AB4-8474-2258D27DD165--

--===============0711780009==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--===============0711780009==--

From libssh2-devel-bounces@cool.haxx.se  Tue Apr  2 01:33:34 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x31NXI1J014885;
	Tue, 2 Apr 2019 01:33:31 +0200
Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com
 [IPv6:2a00:1450:4864:20:0:0:0:434])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x31NXHq8014874
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Tue, 2 Apr 2019 01:33:17 +0200
Received: by mail-wr1-x434.google.com with SMTP id k11so14203830wro.5
 for <libssh2-devel@cool.haxx.se>; Mon, 01 Apr 2019 16:33:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
 bh=+D/RzF9ASFcGtt4qDVQEbQ5lDYaz36PYAibcLnlcUlw=;
 b=fx3xL5g8eK5AJqW1kQSxDzaVOXbdR0hRrf6OJZOpGuMqxGIOP59v+bHag1iIh/vudf
 l5Qrt6Axq17y6Brt4EIEDKsZJPQjXMQtsaIfcv+nm/HV0KXfZeLCYvOacwx7wXEgFsqb
 xLesRNprSRThjYUhBiW3nv1jQFwXElprn/dwjkJEIpZzA6nYjifDIYDVA5igjGu5RH/1
 6Rw3ymCzYo8uMe+nfvPQTjDN8XOOioyr2ef5W4FdO12PECM2ZyNamVUmZpGWCHYGYGNc
 2+iggA2UlOsA6TFEWInYf4gV+70Ak2eHeJunWXD1tlQiQXJraul7YQDj/RfrbDvPzAuB
 OVTA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:references:in-reply-to:from:date
 :message-id:subject:to;
 bh=+D/RzF9ASFcGtt4qDVQEbQ5lDYaz36PYAibcLnlcUlw=;
 b=XjT+eA53JCAKYUxWeUs8mA5T3s89YC+Zzycs9LOlcUgUOqkcZSkFMc/76tU90Fwn8m
 0Lh9n7Ma7KGlkw/fj7pbFqvRpbK2FifyadEPiiOM1asFNmr6eibgKMh4EwkEo2080HAS
 br+488ZcdyraIQf4JnbVo6esMBhmZYtDmrTSRLrOXLYhMe4UIHdFUZG1XdYUc60R55ou
 q1qc3TF01hE5Df2NYQX27u2leJGeLe8xkuWQculkGqL8hLUTlqJSD815B5RjtnpqRIbC
 aKBa0YR1Gk+h8ECvn6VY2NG5y8ruhMnXJJm5MVKPxcnRM+rS0mhBulEWJoKaTSIqARJH
 DB7A==
X-Gm-Message-State: APjAAAVuGig56mZTfh8MVt5fkWJSeOT05Tfga40V2KHZe8Hnkdn9NhHL
 gW8+q/dwouoTiVuEipMMTZe9rNAMCpm4aoZTXzvwLXy9YvY=
X-Google-Smtp-Source: APXvYqxY7aqJQwyC356e3ze9EAgEMQ/ktz8kIAlxkYq5MbPTehn4aHVjxKJrB6JakqKr9nR1EC7YxK1gBjyXhzB42/w=
X-Received: by 2002:a5d:4446:: with SMTP id x6mr21727333wrr.147.1554161593647; 
 Mon, 01 Apr 2019 16:33:13 -0700 (PDT)
MIME-Version: 1.0
References: <CABe46HNJKMBcAH_R=2o_rGrWngwC_kobevy+so5t7iRgRrwZ9w@mail.gmail.com>
 <B2950AAF-0CF7-4A5B-8210-7D177DDC73B3@panic.com>
In-Reply-To: <B2950AAF-0CF7-4A5B-8210-7D177DDC73B3@panic.com>
From: Mohammad Ghasemi <mghicho@gmail.com>
Date: Mon, 1 Apr 2019 16:33:02 -0700
Message-ID: <CABe46HOon-jrCPRjC-TQGBM8d14G2NrJf_O6CoAs7OH8=g0WOQ@mail.gmail.com>
Subject: Re: support for ECDH key exchange algorithms?
To: libssh2 development <libssh2-devel@cool.haxx.se>
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: multipart/mixed; boundary="===============2140616081=="
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>

--===============2140616081==
Content-Type: multipart/alternative; boundary="000000000000b6896e05858071b9"

--000000000000b6896e05858071b9
Content-Type: text/plain; charset="UTF-8"

Thanks,
I didn't see them on the https://www.libssh2.org/ website.
do they exist on 1.8.2 release?

On Mon, Apr 1, 2019 at 4:24 PM Will Cosgrove <will@panic.com> wrote:

> ECDH-sha2-* and curve 25519 are both supported on master.
>
> Cheers,
> Will
>
> On Apr 1, 2019, at 4:16 PM, Mohammad Ghasemi <mghicho@gmail.com> wrote:
>
> Is there any plan to add support for ECDH key exchange algorithms?
>
>
>
> --
> ---
> Best Regards
> Mohammad Ghassemi
> _______________________________________________
> libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
>
>
> _______________________________________________
> libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
>


-- 
---
Best Regards
Mohammad Ghassemi

--000000000000b6896e05858071b9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"></div>Thanks,<div>I didn=
&#39;t see them on the=C2=A0<a href=3D"https://www.libssh2.org/">https://ww=
w.libssh2.org/</a> website.=C2=A0</div><div>do they exist on 1.8.2 release?=
=C2=A0</div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"g=
mail_attr">On Mon, Apr 1, 2019 at 4:24 PM Will Cosgrove &lt;<a href=3D"mail=
to:will@panic.com">will@panic.com</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: break-word;">=
ECDH-sha2-* and=C2=A0curve 25519 are both supported on master.<div><br></di=
v><div>Cheers,</div><div>Will<br><div><br><blockquote type=3D"cite"><div>On=
 Apr 1, 2019, at 4:16 PM, Mohammad Ghasemi &lt;<a href=3D"mailto:mghicho@gm=
ail.com" target=3D"_blank">mghicho@gmail.com</a>&gt; wrote:</div><br class=
=3D"gmail-m_5711520715153642891Apple-interchange-newline"><div><div dir=3D"=
ltr">Is there any plan to add support for ECDH key exchange algorithms?<div=
><br></div><div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr" cl=
ass=3D"gmail-m_5711520715153642891gmail_signature"><div dir=3D"ltr"><div><s=
pan style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.=
3333px;background-color:rgb(255,255,255)">---</span><br style=3D"color:rgb(=
34,34,34);font-family:arial,sans-serif;font-size:13.3333px;background-color=
:rgb(255,255,255)"><span style=3D"color:rgb(34,34,34);font-family:arial,san=
s-serif;font-size:13.3333px;background-color:rgb(255,255,255)">Best Regards=
</span><br style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-s=
ize:13.3333px;background-color:rgb(255,255,255)"><span style=3D"color:rgb(3=
4,34,34);font-family:arial,sans-serif;font-size:13.3333px;background-color:=
rgb(255,255,255)">Mohammad Ghassemi</span><br></div></div></div></div></div=
>
_______________________________________________<br>libssh2-devel <a href=3D=
"https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel" target=3D"_bl=
ank">https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel</a><br></d=
iv></blockquote></div><br></div></div>_____________________________________=
__________<br>
libssh2-devel <a href=3D"https://cool.haxx.se/cgi-bin/mailman/listinfo/libs=
sh2-devel" rel=3D"noreferrer" target=3D"_blank">https://cool.haxx.se/cgi-bi=
n/mailman/listinfo/libssh2-devel</a><br>
</blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"=
 class=3D"gmail_signature"><div dir=3D"ltr"><div><span style=3D"color:rgb(3=
4,34,34);font-family:arial,sans-serif;font-size:13.3333px;background-color:=
rgb(255,255,255)">---</span><br style=3D"color:rgb(34,34,34);font-family:ar=
ial,sans-serif;font-size:13.3333px;background-color:rgb(255,255,255)"><span=
 style=3D"color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.333=
3px;background-color:rgb(255,255,255)">Best Regards</span><br style=3D"colo=
r:rgb(34,34,34);font-family:arial,sans-serif;font-size:13.3333px;background=
-color:rgb(255,255,255)"><span style=3D"color:rgb(34,34,34);font-family:ari=
al,sans-serif;font-size:13.3333px;background-color:rgb(255,255,255)">Mohamm=
ad Ghassemi</span><br></div></div></div></div></div></div>

--000000000000b6896e05858071b9--

--===============2140616081==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--===============2140616081==--

From libssh2-devel-bounces@cool.haxx.se  Tue Apr  2 01:38:20 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x31Nc9nR017981;
	Tue, 2 Apr 2019 01:38:20 +0200
Received: from mail.panic.com (mail.panic.com [38.103.165.36])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x31Nc6il017833
 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Tue, 2 Apr 2019 01:38:07 +0200
Received: from [10.0.0.249] (unknown [10.0.0.249])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mail.panic.com (Postfix) with ESMTPSA id 6CD607C7
 for <libssh2-devel@cool.haxx.se>; Mon,  1 Apr 2019 16:38:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=panic.com; s=dkim;
 t=1554161882; bh=jYkY/i8h1ygUwdWL5I7bVjYEqxVyeQ6ba82r9x4VWag=;
 h=From:Subject:Date:References:To:In-Reply-To;
 b=Gw6rT3NKB+xD2i8L6P+LPOCGnBCIqg+7Xc8jMVFiO/gtZJN6HkJponxjJoE7AXxid
 sxtz5jfX13A59MlDxTKo9tg0HZ6lw4nEzQoqwX02zHYXj/HTZQokwolotVywXckTl9
 w/HxBGPcaQsh+uUwufKIr38EUFV0TU7wwwTBAnnQ=
From: Will Cosgrove <will@panic.com>
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\))
Subject: Re: support for ECDH key exchange algorithms?
Date: Mon, 1 Apr 2019 16:38:02 -0700
References: <CABe46HNJKMBcAH_R=2o_rGrWngwC_kobevy+so5t7iRgRrwZ9w@mail.gmail.com>
 <B2950AAF-0CF7-4A5B-8210-7D177DDC73B3@panic.com>
 <CABe46HOon-jrCPRjC-TQGBM8d14G2NrJf_O6CoAs7OH8=g0WOQ@mail.gmail.com>
To: libssh2 development <libssh2-devel@cool.haxx.se>
In-Reply-To: <CABe46HOon-jrCPRjC-TQGBM8d14G2NrJf_O6CoAs7OH8=g0WOQ@mail.gmail.com>
Message-Id: <A52BA538-270F-446E-970B-C2D71588BA0B@panic.com>
X-Mailer: Apple Mail (2.3445.104.8)
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: multipart/mixed; boundary="===============0382347807=="
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>


--===============0382347807==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_BA9EA9B9-1F23-465B-A885-53C67E08086E"


--Apple-Mail=_BA9EA9B9-1F23-465B-A885-53C67E08086E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

No, only on the master branch which has yet to ship. You can find the =
latest source here: http://github.com/libssh2/libssh2

Will

> On Apr 1, 2019, at 4:33 PM, Mohammad Ghasemi <mghicho@gmail.com> =
wrote:
>=20
> Thanks,
> I didn't see them on the https://www.libssh2.org/ =
<https://www.libssh2.org/> website.=20
> do they exist on 1.8.2 release?=20
>=20
> On Mon, Apr 1, 2019 at 4:24 PM Will Cosgrove <will@panic.com =
<mailto:will@panic.com>> wrote:
> ECDH-sha2-* and curve 25519 are both supported on master.
>=20
> Cheers,
> Will
>=20
>> On Apr 1, 2019, at 4:16 PM, Mohammad Ghasemi <mghicho@gmail.com =
<mailto:mghicho@gmail.com>> wrote:
>>=20
>> Is there any plan to add support for ECDH key exchange algorithms?


--Apple-Mail=_BA9EA9B9-1F23-465B-A885-53C67E08086E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">No, =
only on the master branch which has yet to ship. You can find the latest =
source here:&nbsp;<a href=3D"http://github.com/libssh2/libssh2" =
class=3D"">http://github.com/libssh2/libssh2</a><div class=3D""><br =
class=3D""></div><div class=3D"">Will<br class=3D""><div><br =
class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Apr =
1, 2019, at 4:33 PM, Mohammad Ghasemi &lt;<a =
href=3D"mailto:mghicho@gmail.com" class=3D"">mghicho@gmail.com</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" =
class=3D""></div>Thanks,<div class=3D"">I didn't see them on the&nbsp;<a =
href=3D"https://www.libssh2.org/" class=3D"">https://www.libssh2.org/</a> =
website.&nbsp;</div><div class=3D"">do they exist on 1.8.2 =
release?&nbsp;</div><div class=3D""><br class=3D""><div =
class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Apr =
1, 2019 at 4:24 PM Will Cosgrove &lt;<a href=3D"mailto:will@panic.com" =
class=3D"">will@panic.com</a>&gt; wrote:<br class=3D""></div><blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: =
break-word;" class=3D"">ECDH-sha2-* and&nbsp;curve 25519 are both =
supported on master.<div class=3D""><br class=3D""></div><div =
class=3D"">Cheers,</div><div class=3D"">Will<br class=3D""><div =
class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><div =
class=3D"">On Apr 1, 2019, at 4:16 PM, Mohammad Ghasemi &lt;<a =
href=3D"mailto:mghicho@gmail.com" target=3D"_blank" =
class=3D"">mghicho@gmail.com</a>&gt; wrote:</div><br =
class=3D"gmail-m_5711520715153642891Apple-interchange-newline"><div =
class=3D""><div dir=3D"ltr" class=3D"">Is there any plan to add support =
for ECDH key exchange =
algorithms?</div></div></blockquote></div></div></div></blockquote></div><=
/div></div></div></div></blockquote></div><br =
class=3D""></div></body></html>=

--Apple-Mail=_BA9EA9B9-1F23-465B-A885-53C67E08086E--

--===============0382347807==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--===============0382347807==--

From libssh2-devel-bounces@cool.haxx.se  Wed Apr  3 22:45:56 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x33KjGLK021513;
	Wed, 3 Apr 2019 22:45:48 +0200
Received: from mail-lj1-x243.google.com (mail-lj1-x243.google.com
 [IPv6:2a00:1450:4864:20:0:0:0:243])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x33KjF2j021382
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Wed, 3 Apr 2019 22:45:15 +0200
Received: by mail-lj1-x243.google.com with SMTP id v13so93234ljk.4
 for <libssh2-devel@cool.haxx.se>; Wed, 03 Apr 2019 13:45:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=from:subject:to:references:message-id:date:user-agent:mime-version
 :in-reply-to:content-language:content-transfer-encoding;
 bh=5OLhX5V9iyDrP7P9Pou5LnTCsxjvP9PnOdzst9vabL4=;
 b=eTNsIPGLA6D+VGCfPV1CqpZFW0fMhgsNVB1Pyw2pdT9LOTJFzf91bZnVwsOdyBbaQR
 YzvoD8Yb/5fdd+S1B1Jqx3VW9GQwU8DAIH11S+29J3vsroZwC1HtOoSNizZdqXOT8gjZ
 8SEoL0e731pLT33aNX14bpddByvP5yNjlf0QIPdcHZbI/Aw3bEl8MBNixExIacQh2pRt
 PUzqD6MyK/PC5w0bSd4ALHP9nf5ZycgB8h9W0pf5uI74J6jcQKCDLWT3+59f1RnyWcUD
 FEYzxhk1wvLhY1nRe6aGi+msH1W6+VUrSuFRdQeLN/UgnntupFpSVUejoKeDIbk8Dunm
 jefA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:from:subject:to:references:message-id:date
 :user-agent:mime-version:in-reply-to:content-language
 :content-transfer-encoding;
 bh=5OLhX5V9iyDrP7P9Pou5LnTCsxjvP9PnOdzst9vabL4=;
 b=kqMsFNu0F4/1Gm5+yB5mAFDmQNJq+Et81ffg9YSNjw47XN1tp4toFJlrynvmH2jwAa
 XEJADr/jx+JQSSxhUa6RtNKhCLYI7EPuJtN8opNU6lxka5VvvaheE73XqcTbFGQmCCpm
 RM7EIiITTDo0OXrQ2JT4C02zrli52vsub8m5klYUzqTKfUB4Ol5BzdpQV0hgUIr+xkvK
 HwurDn2k5kdP9n/UcB0JnEwZ0yrx+pyFcifq4SzDzoCPUMdm8D7BuqDA7/l/D/1oE7gx
 w4hFff6AgeibWF0wWAvVpK56SJk/O/V+/DOaZVxG65KxbrHSKBlbBuCwu/XALjlfGzAf
 uK4w==
X-Gm-Message-State: APjAAAUbpJJkfbCQlNznzjJbYD0py5N1MKbnwu2zcK9lITbscMx+7yW1
 hi/L4tvkjtcGoem5596zmcchzx9A
X-Google-Smtp-Source: APXvYqwVwjoyTkprk/2+ZW48jhAr8H0+4mNnhN4y2Wj3fWu9fFG/yzEbUx1tUfYuTkNnTICZTVfvng==
X-Received: by 2002:a2e:3e18:: with SMTP id l24mr1139335lja.68.1554324310957; 
 Wed, 03 Apr 2019 13:45:10 -0700 (PDT)
Received: from ?IPv6:2a00:1370:8125:1707:3e2f:a579:be49:2d8a?
 ([2a00:1370:8125:1707:3e2f:a579:be49:2d8a])
 by smtp.googlemail.com with ESMTPSA id 73sm3792282ljf.72.2019.04.03.13.45.09
 for <libssh2-devel@cool.haxx.se>
 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
 Wed, 03 Apr 2019 13:45:10 -0700 (PDT)
From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
Subject: Re: [PATCH][WIP][v2] Fix out-of-buffer-boundary reads
To: libssh2-devel@cool.haxx.se
References: <CAD9rwMoHmS0_WoAP-=M6WXG_DherCgDWeyBrEGO8-99yq5d70g@mail.gmail.com>
 <m3vb5bmq6j.fsf@gmail.com> <m3a8lju3e3.fsf@gmail.com>
 <alpine.DEB.2.20.1903182209050.22468@tvnag.unkk.fr>
 <8cc68255-11c0-5800-dfcc-d5da595d8874@gmail.com>
 <d72bc4be-28c3-6405-7780-e6392e032a5e@gmail.com>
 <7DF9FA2F-FAF8-478E-B56B-4D8C04688FBF@panic.com>
Message-ID: <40269726-fef3-2a21-5ef8-724ef0af7ea6@gmail.com>
Date: Wed, 3 Apr 2019 23:45:07 +0300
User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <7DF9FA2F-FAF8-478E-B56B-4D8C04688FBF@panic.com>
Content-Language: en-US
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: text/plain; charset="utf-8"
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by giant.haxx.se id x33KjGLK021513

On 2019-03-31 11:38 , Will Cosgrove wrote:
> The 1.8.x branch fixes only resolves the issues brought up by the
> Conicanal review while master contains a more exhaustive review and is
> highly recommended to use.

Stable distro won't use git master. You can say it is "downstream
problem", but it won't change the end result: either upstream provides
backport(ed|able) security fixes for few previous branches, or most of
end users will use vulnerable code for years.

And fixes in libssh2 git master are not backportable, 1.8.x branch is.

> I will submit a patch on Monday for the check length function, thanks
> for bringing that to our attention.

Not sure if it is still possible to practically exploit it (as of
c07bc647f), but those (int) casts are wrong (and unneeded).

Anyway, /proper/ check is:

-    if(len > buf->len)
-        return 0;
-
-    return ((int)(buf->dataptr - buf->data) <= (int)(buf->len - len)) ? 1 : 0;
+    return len <= (size_t)((buf->data + buf->len) - buf->dataptr);

> That said, the project is in need of people who contribute and it
> would be very helpful if you would submit a PR regardless of past PRs
> not being taken for whatever reason.

I'm able to identify certain class of problems (as I said below in OP, "code
around _libssh2_ntohu32 often looks wrong, please review and fix it"), but
I don't understand libssh2 code to extent I can design replacement.

>> On Mar 31, 2019, at 11:22 AM, Yuriy M. Kaminskiy <yumkam@gmail.com> wrote:
>> 
>>> On 31.03.2019 14:23, Yuriy M. Kaminskiy wrote:
>>> FTR, (some) problems that was addressed by this patch was (apparently
>>> independently) rediscovered 3 years later, assigned CVE-2019-38{55...63}
>>> and fixed (differently; I have not checked if fixed code covers all
>>> cases was covered by my patch).
>>> 
>>> BTW, _libssh2_check_length() that is extensively used by current code is
>>> broken/incorrect; e.g. suppose
>>> 
>>>   buf->dataptr = buf->data, buf->len = 5, len = 0xfffffff7
>>> 
>>> then _libssh2_check_length(buf, len) will return 1; uh-doh.
>>> 
>>> With obvious security implications.
>>> 
>>> (No, I'm not going to compose patch to be ignored for another 3 years).
>> 
>> Ah, yeah, forgot to look at 1.8.x branch. No _check_length there, but
>> other problematic code present instead:
>> 
>>   uint32_t len = _libssh2_ntohu32(data + 5);
>>   ...
>>   if((len + 9) < datalen)
>> 
>> Broken when len > UINT32_MAX - 9.
>> 
>>   if(datalen >= 9) {
>>       message_len = _libssh2_ntohu32(data + 5);
>>       if(message_len < datalen-13) {
>> 
>> Broken when datalen >= 9 && datalen < 13 (and there are more similar code).
>> 
>> etc.
>> 
>>>> On 2016-03-27 22:28 , Yuriy M. Kaminskiy wrote:
>>>> Ping? I'd like to stress out this issue has security imlications. At
>>>> very least, DoS (and this is not a standalone application, so it is not
>>>> a minor issue), and maybe host memory exposure too. (However, it is only
>>>> heap over-reads, without heap/stack over-writes, so no risk of
>>>> escalating to remote code execution).
>>>> 
>>>>> On 02/25/16 03:10 , Yuriy M. Kaminskiy wrote:
>>>>> "George Garner (online)" <ggarner_online@gmgsystemsinc.com> writes:
>>>>> [...]
>>>>>> 3. Where is the p_len/group_order parameter validated? In
>>>>>> kex_method_diffie_hellman_group_exchange_sha256_key_exchange it is
>>>>>> converted from network byte order and accepted at face value. What
>>>>>> happens if a malicious packet is received with a bogus value for
>>>>>> p_len?
>>>>> 
>>>>> Maybe I miss something, but it looks like this defect (blindly trust
>>>>> various 32-bit length that was sent remote side and don't verify if it
>>>>> fits buffer) is *everywhere* in libssh2. I've sent some patches for
>>>>> kex.c via gh pull request, but quickly discovered it is much worse. Very
>>>>> WIP (and incomplete) patch for *other* files is attached; unfortunately,
>>>>> in most cases, I have no idea how such errors should be handled within libssh2,
>>>>> don't know libssh2 code base well enough, so I give up at this.
>>>>> 
>>>>> Note that in early connection setup "malicious server" is not required,
>>>>> "malicious MITM" can insert broken packets as well.
>>>>> 
>>>>> In general, please re-review all `grep ntoh -r src/`, in many cases
>>>>> surrounding code looks problematic in one way or other.
>>>>> 
>>>>> 
>>>>> ---
>>>>> Changelog:
>>>>> v2: fixed obvious errors
>>>>> Note: This is still NOT COMPLETE work, all XXX comment must be reviewed and acted upon.
>>>>> 
>>>>> src/agent.c     |  32 ++++++++--------
>>>>> src/channel.c   |  10 ++++-
>>>>> src/hostkey.c   |  19 +++++++--
>>>>> src/kex.c       |  43 +++++++++++----------
>>>>> src/packet.c    |  45 +++++++++++++++++-----
>>>>> src/publickey.c | 117 +++++++++++++++++++++++++++++++++++++++++++-------------
>>>>> src/session.c   |   2 +
>>>>> src/sftp.c      |  42 ++++++++++++++++----
>>>>> src/sftp.h      |   1 +
>>>>> src/userauth.c  |  32 ++++++++++++++++
>>>>> 10 files changed, 260 insertions(+), 83 deletions(-)
>>>>> 
>>>>> diff --git a/src/agent.c b/src/agent.c
>>>>> index c2ba422..255b63d 100644
>>>>> --- a/src/agent.c
>>>>> +++ b/src/agent.c
>>>>> @@ -449,12 +449,12 @@ agent_sign(LIBSSH2_SESSION *session, unsigned char **sig, size_t *sig_len,
>>>>>         goto error;
>>>>>     }
>>>>>     method_len = _libssh2_ntohu32(s);
>>>>> -    s += 4;
>>>>> -    len -= method_len;
>>>>> -    if (len < 0) {
>>>>> +    if (method_len < 0 || len < method_len) {
>>>>>         rc = LIBSSH2_ERROR_AGENT_PROTOCOL;
>>>>>         goto error;
>>>>>     }
>>>>> +    s += 4;
>>>>> +    len -= method_len;
>>>>>     s += method_len;
>>>>> 
>>>>>     /* Read the signature */
>>>>> @@ -464,12 +464,12 @@ agent_sign(LIBSSH2_SESSION *session, unsigned char **sig, size_t *sig_len,
>>>>>         goto error;
>>>>>     }
>>>>>     *sig_len = _libssh2_ntohu32(s);
>>>>> -    s += 4;
>>>>> -    len -= *sig_len;
>>>>> -    if (len < 0) {
>>>>> +    if ((size_t)len < *sig_len) {
>>>>>         rc = LIBSSH2_ERROR_AGENT_PROTOCOL;
>>>>>         goto error;
>>>>>     }
>>>>> +    len -= *sig_len;
>>>>> +    s += 4;
>>>>> 
>>>>>     *sig = LIBSSH2_ALLOC(session, *sig_len);
>>>>>     if (!*sig) {
>>>>> @@ -558,15 +558,15 @@ agent_list_identities(LIBSSH2_AGENT *agent)
>>>>>             goto error;
>>>>>         }
>>>>>         identity->external.blob_len = _libssh2_ntohu32(s);
>>>>> -        s += 4;
>>>>> -
>>>>> -        /* Read the blob */
>>>>> -        len -= identity->external.blob_len;
>>>>> -        if (len < 0) {
>>>>> +        if ((size_t)len < identity->external.blob_len) {
>>>>>             rc = LIBSSH2_ERROR_AGENT_PROTOCOL;
>>>>>             LIBSSH2_FREE(agent->session, identity);
>>>>>             goto error;
>>>>>         }
>>>>> +        s += 4;
>>>>> +
>>>>> +        /* Read the blob */
>>>>> +        len -= identity->external.blob_len;
>>>>> 
>>>>>         identity->external.blob = LIBSSH2_ALLOC(agent->session,
>>>>>                                                 identity->external.blob_len);
>>>>> @@ -587,16 +587,16 @@ agent_list_identities(LIBSSH2_AGENT *agent)
>>>>>             goto error;
>>>>>         }
>>>>>         comment_len = _libssh2_ntohu32(s);
>>>>> -        s += 4;
>>>>> -
>>>>> -        /* Read the comment */
>>>>> -        len -= comment_len;
>>>>> -        if (len < 0) {
>>>>> +        if (comment_len < 0 || len < comment_len) {
>>>>>             rc = LIBSSH2_ERROR_AGENT_PROTOCOL;
>>>>>             LIBSSH2_FREE(agent->session, identity->external.blob);
>>>>>             LIBSSH2_FREE(agent->session, identity);
>>>>>             goto error;
>>>>>         }
>>>>> +        s += 4;
>>>>> +
>>>>> +        /* Read the comment */
>>>>> +        len -= comment_len;
>>>>> 
>>>>>         identity->external.comment = LIBSSH2_ALLOC(agent->session,
>>>>>                                                    comment_len + 1);
>>>>> diff --git a/src/channel.c b/src/channel.c
>>>>> index 32d914d..38572be 100644
>>>>> --- a/src/channel.c
>>>>> +++ b/src/channel.c
>>>>> @@ -225,6 +225,7 @@ _libssh2_channel_open(LIBSSH2_SESSION * session, const char *channel_type,
>>>>>     }
>>>>> 
>>>>>     if (session->open_state == libssh2_NB_state_sent) {
>>>>> +        unsigned char *end;
>>>>>         rc = _libssh2_packet_requirev(session, reply_codes,
>>>>>                                       &session->open_data,
>>>>>                                       &session->open_data_len, 1,
>>>>> @@ -238,7 +239,11 @@ _libssh2_channel_open(LIBSSH2_SESSION * session, const char *channel_type,
>>>>>             goto channel_error;
>>>>>         }
>>>>> 
>>>>> +        end = session->open_data + session->open_data_len;
>>>>> +
>>>>>         if (session->open_data[0] == SSH_MSG_CHANNEL_OPEN_CONFIRMATION) {
>>>>> +            if (13+4 > (end - session->open_data))
>>>>> +                goto channel_error;
>>>>>             session->open_channel->remote.id =
>>>>>                 _libssh2_ntohu32(session->open_data + 5);
>>>>>             session->open_channel->local.window_size =
>>>>> @@ -265,7 +270,8 @@ _libssh2_channel_open(LIBSSH2_SESSION * session, const char *channel_type,
>>>>>             return session->open_channel;
>>>>>         }
>>>>> 
>>>>> -        if (session->open_data[0] == SSH_MSG_CHANNEL_OPEN_FAILURE) {
>>>>> +        if (session->open_data[0] == SSH_MSG_CHANNEL_OPEN_FAILURE &&
>>>>> +            4 <= (end - (session->open_data + 5))) {
>>>>>             unsigned int reason_code = _libssh2_ntohu32(session->open_data + 5);
>>>>>             switch (reason_code) {
>>>>>             case SSH_OPEN_ADMINISTRATIVELY_PROHIBITED:
>>>>> @@ -1399,6 +1405,7 @@ _libssh2_channel_flush(LIBSSH2_CHANNEL *channel, int streamid)
>>>>> 
>>>>>             if (((packet_type == SSH_MSG_CHANNEL_DATA)
>>>>>                  || (packet_type == SSH_MSG_CHANNEL_EXTENDED_DATA))
>>>>> +                && packet->data_len >= 5 + (packet_type == SSH_MSG_CHANNEL_EXTENDED_DATA ? 4 : 0)
>>>>>                 && (_libssh2_ntohu32(packet->data + 1) == channel->local.id)) {
>>>>>                 /* It's our channel at least */
>>>>>                 long packet_stream_id =
>>>>> @@ -1418,6 +1425,7 @@ _libssh2_channel_flush(LIBSSH2_CHANNEL *channel, int streamid)
>>>>>                                    bytes_to_flush, packet_stream_id,
>>>>>                                    channel->local.id, channel->remote.id);
>>>>> 
>>>>> +                    /* XXX assert(packet->data_len >= 13); XXX */
>>>>>                     /* It's one of the streams we wanted to flush */
>>>>>                     channel->flush_refund_bytes += packet->data_len - 13;
>>>>>                     channel->flush_flush_bytes += bytes_to_flush;
>>>>> diff --git a/src/hostkey.c b/src/hostkey.c
>>>>> index 2a0a8f9..7b780e2 100644
>>>>> --- a/src/hostkey.c
>>>>> +++ b/src/hostkey.c
>>>>> @@ -66,31 +66,42 @@ hostkey_method_ssh_rsa_init(LIBSSH2_SESSION * session,
>>>>>     libssh2_rsa_ctx *rsactx;
>>>>>     const unsigned char *s, *e, *n;
>>>>>     unsigned long len, e_len, n_len;
>>>>> +    const unsigned char *end = hostkey_data + hostkey_data_len;
>>>>>     int ret;
>>>>> 
>>>>> -    (void) hostkey_data_len;
>>>>> -
>>>>>     if (*abstract) {
>>>>>         hostkey_method_ssh_rsa_dtor(session, abstract);
>>>>>         *abstract = NULL;
>>>>>     }
>>>>> 
>>>>>     s = hostkey_data;
>>>>> +    if (4 > end - s)
>>>>> +        return -1;
>>>>>     len = _libssh2_ntohu32(s);
>>>>>     s += 4;
>>>>> +    if (len > (size_t)(end - s))
>>>>> +        return -1;
>>>>> 
>>>>>     if (len != 7 || strncmp((char *) s, "ssh-rsa", 7) != 0) {
>>>>>         return -1;
>>>>>     }
>>>>> -    s += 7;
>>>>> +    s += len;
>>>>> 
>>>>> +    if (4 > end - s)
>>>>> +        return -1;
>>>>>     e_len = _libssh2_ntohu32(s);
>>>>>     s += 4;
>>>>> +    if (e_len > (size_t)(end - s))
>>>>> +        return -1;
>>>>> 
>>>>>     e = s;
>>>>>     s += e_len;
>>>>> +    if (4 > end - s)
>>>>> +        return -1;
>>>>>     n_len = _libssh2_ntohu32(s);
>>>>>     s += 4;
>>>>> +    if (n_len > (size_t)(end - s))
>>>>> +        return -1;
>>>>>     n = s;
>>>>> 
>>>>>     ret = _libssh2_rsa_new(&rsactx, e, e_len, n, n_len, NULL, 0,
>>>>> @@ -181,6 +192,8 @@ hostkey_method_ssh_rsa_sig_verify(LIBSSH2_SESSION * session,
>>>>>     (void) session;
>>>>> 
>>>>>     /* Skip past keyname_len(4) + keyname(7){"ssh-rsa"} + signature_len(4) */
>>>>> +    if (15 > sig_len)
>>>>> +        return -1;
>>>>>     sig += 15;
>>>>>     sig_len -= 15;
>>>>>     return _libssh2_rsa_sha1_verify(rsactx, sig, sig_len, m, m_len);
>>>>> diff --git a/src/kex.c b/src/kex.c
>>>>> index 40dbeab..2381d52 100644
>>>>> --- a/src/kex.c
>>>>> +++ b/src/kex.c
>>>>> @@ -2463,21 +2463,20 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
>>>>>  * within the given packet.
>>>>>  */
>>>>> static int kex_string_pair(unsigned char **sp,   /* parsing position */
>>>>> -                           unsigned char *data,  /* start pointer to packet */
>>>>> -                           size_t data_len,      /* size of total packet */
>>>>> +                           unsigned char *end,   /* end of packet */
>>>>>                            size_t *lenp,         /* length of the string */
>>>>>                            unsigned char **strp) /* pointer to string start */
>>>>> {
>>>>>     unsigned char *s = *sp;
>>>>> -    *lenp = _libssh2_ntohu32(s);
>>>>> 
>>>>> -    /* the length of the string must fit within the current pointer and the
>>>>> -       end of the packet */
>>>>> -    if (*lenp > (data_len - (s - data) -4))
>>>>> +    if (4 > end - s)
>>>>>         return 1;
>>>>> -    *strp = s + 4;
>>>>> -    s += 4 + *lenp;
>>>>> -
>>>>> +    *lenp = _libssh2_ntohu32(s);
>>>>> +    s += 4;
>>>>> +    if (*lenp > (size_t)(end - s))
>>>>> +        return 1;
>>>>> +    *strp = s;
>>>>> +    s += *lenp;
>>>>>     *sp = s;
>>>>>     return 0;
>>>>> }
>>>>> @@ -2493,6 +2492,10 @@ static int kex_agree_methods(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>     size_t kex_len, hostkey_len, crypt_cs_len, crypt_sc_len, comp_cs_len;
>>>>>     size_t comp_sc_len, mac_cs_len, mac_sc_len;
>>>>>     unsigned char *s = data;
>>>>> +    unsigned char *end = data + data_len;
>>>>> +
>>>>> +    if (1 + 16 > end - s)
>>>>> +       return -1; 
>>>>> 
>>>>>     /* Skip packet_type, we know it already */
>>>>>     s++;
>>>>> @@ -2501,21 +2504,24 @@ static int kex_agree_methods(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>     s += 16;
>>>>> 
>>>>>     /* Locate each string */
>>>>> -    if(kex_string_pair(&s, data, data_len, &kex_len, &kex))
>>>>> +    if(kex_string_pair(&s, end, &kex_len, &kex))
>>>>> +        return -1;
>>>>> +    if(kex_string_pair(&s, end, &hostkey_len, &hostkey))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &hostkey_len, &hostkey))
>>>>> +    if(kex_string_pair(&s, end, &crypt_cs_len, &crypt_cs))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &crypt_cs_len, &crypt_cs))
>>>>> +    if(kex_string_pair(&s, end, &crypt_sc_len, &crypt_sc))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &crypt_sc_len, &crypt_sc))
>>>>> +    if(kex_string_pair(&s, end, &mac_cs_len, &mac_cs))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &mac_cs_len, &mac_cs))
>>>>> +    if(kex_string_pair(&s, end, &mac_sc_len, &mac_sc))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &mac_sc_len, &mac_sc))
>>>>> +    if(kex_string_pair(&s, end, &comp_cs_len, &comp_cs))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &comp_cs_len, &comp_cs))
>>>>> +    if(kex_string_pair(&s, end, &comp_sc_len, &comp_sc))
>>>>>         return -1;
>>>>> -    if(kex_string_pair(&s, data, data_len, &comp_sc_len, &comp_sc))
>>>>> +
>>>>> +    if (1 > end - s)
>>>>>         return -1;
>>>>> 
>>>>>     /* If the server sent an optimistic packet, assume that it guessed wrong.
>>>>> @@ -2524,9 +2530,6 @@ static int kex_agree_methods(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>     session->burn_optimistic_kexinit = *(s++);
>>>>>     /* Next uint32 in packet is all zeros (reserved) */
>>>>> 
>>>>> -    if (data_len < (unsigned) (s - data))
>>>>> -        return -1;              /* short packet */
>>>>> -
>>>>>     if (kex_agree_kex_hostkey(session, kex, kex_len, hostkey, hostkey_len)) {
>>>>>         return -1;
>>>>>     }
>>>>> diff --git a/src/packet.c b/src/packet.c
>>>>> index 5f1feb8..3659daa 100644
>>>>> --- a/src/packet.c
>>>>> +++ b/src/packet.c
>>>>> @@ -85,10 +85,12 @@ packet_queue_listener(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>     char failure_code = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
>>>>>     int rc;
>>>>> 
>>>>> -    (void) datalen;
>>>>> -
>>>>>     if (listen_state->state == libssh2_NB_state_idle) {
>>>>>         unsigned char *s = data + (sizeof("forwarded-tcpip") - 1) + 5;
>>>>> +        unsigned char *end = data + datalen;
>>>>> +        if (4*4 > (end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         listen_state->sender_channel = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>> 
>>>>> @@ -99,15 +101,27 @@ packet_queue_listener(LIBSSH2_SESSION * session, unsigned char *data,
>>>>> 
>>>>>         listen_state->host_len = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>> +        if (listen_state->host_len > (size_t)(end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         listen_state->host = s;
>>>>>         s += listen_state->host_len;
>>>>> +        if (4*2 > (end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         listen_state->port = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>> 
>>>>>         listen_state->shost_len = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>> +        if (listen_state->shost_len > (size_t)(end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         listen_state->shost = s;
>>>>>         s += listen_state->shost_len;
>>>>> +        if (4 > (end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         listen_state->sport = _libssh2_ntohu32(s);
>>>>> 
>>>>>         _libssh2_debug(session, LIBSSH2_TRACE_CONN,
>>>>> @@ -271,10 +285,12 @@ packet_x11_open(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>     LIBSSH2_CHANNEL *channel = x11open_state->channel;
>>>>>     int rc;
>>>>> 
>>>>> -    (void) datalen;
>>>>> -
>>>>>     if (x11open_state->state == libssh2_NB_state_idle) {
>>>>>         unsigned char *s = data + (sizeof("x11") - 1) + 5;
>>>>> +        unsigned char *end = data + datalen;
>>>>> +        if (4*4 > (end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         x11open_state->sender_channel = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>>         x11open_state->initial_window_size = _libssh2_ntohu32(s);
>>>>> @@ -283,8 +299,14 @@ packet_x11_open(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>         s += 4;
>>>>>         x11open_state->shost_len = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>> +        if (x11open_state->shost_len > (size_t)(end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         x11open_state->shost = s;
>>>>>         s += x11open_state->shost_len;
>>>>> +        if (4 > (end - s)) {
>>>>> +            return 0; /* XXX ??? XXX */
>>>>> +        }
>>>>>         x11open_state->sport = _libssh2_ntohu32(s);
>>>>> 
>>>>>         _libssh2_debug(session, LIBSSH2_TRACE_CONN,
>>>>> @@ -807,22 +829,26 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>                 else if (len == sizeof("exit-signal") - 1
>>>>>                          && !memcmp("exit-signal", data + 9,
>>>>>                                     sizeof("exit-signal") - 1)) {
>>>>> +                    unsigned char *end = data + datalen;
>>>>> +                    unsigned char *s = data + 9 + sizeof("exit-signal");
>>>>>                     /* command terminated due to signal */
>>>>>                     if(datalen >= 20)
>>>>>                         channelp = _libssh2_channel_locate(session, channel);
>>>>> 
>>>>> -                    if (channelp) {
>>>>> +                    if (channelp && end - s >= 4) {
>>>>>                         /* set signal name (without SIG prefix) */
>>>>> -                        uint32_t namelen =
>>>>> -                            _libssh2_ntohu32(data + 9 + sizeof("exit-signal"));
>>>>> +                        uint32_t namelen = _libssh2_ntohu32(s);
>>>>> +                        s += 4;
>>>>> +                        if (namelen > (size_t)(end - s))
>>>>> +                            /* XXX ??? XXX */;
>>>>> +                        else {
>>>>>                         channelp->exit_signal =
>>>>>                             LIBSSH2_ALLOC(session, namelen + 1);
>>>>>                         if (!channelp->exit_signal)
>>>>>                             rc = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,
>>>>>                                                 "memory for signal name");
>>>>>                         else {
>>>>> -                            memcpy(channelp->exit_signal,
>>>>> -                                   data + 13 + sizeof("exit_signal"), namelen);
>>>>> +                            memcpy(channelp->exit_signal, s, namelen);
>>>>>                             channelp->exit_signal[namelen] = '\0';
>>>>>                             /* TODO: save error message and language tag */
>>>>>                             _libssh2_debug(session, LIBSSH2_TRACE_CONN,
>>>>> @@ -832,6 +858,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
>>>>>                                            channelp->local.id,
>>>>>                                            channelp->remote.id);
>>>>>                         }
>>>>> +                        }
>>>>>                     }
>>>>>                 }
>>>>> 
>>>>> diff --git a/src/publickey.c b/src/publickey.c
>>>>> index bfee0a8..d19efb7 100644
>>>>> --- a/src/publickey.c
>>>>> +++ b/src/publickey.c
>>>>> @@ -247,6 +247,7 @@ publickey_response_success(LIBSSH2_PUBLICKEY * pkey)
>>>>>         switch (response) {
>>>>>         case LIBSSH2_PUBLICKEY_RESPONSE_STATUS:
>>>>>             /* Error, or processing complete */
>>>>> +        if (data_len >= 4)
>>>>>         {
>>>>>             unsigned long status = _libssh2_ntohu32(s);
>>>>> 
>>>>> @@ -258,6 +259,7 @@ publickey_response_success(LIBSSH2_PUBLICKEY * pkey)
>>>>>             publickey_status_error(pkey, session, status);
>>>>>             return -1;
>>>>>         }
>>>>> +        /* fallthru */
>>>>>         default:
>>>>>             LIBSSH2_FREE(session, data);
>>>>>             if (response < 0) {
>>>>> @@ -403,6 +405,7 @@ static LIBSSH2_PUBLICKEY *publickey_init(LIBSSH2_SESSION *session)
>>>>>     if (session->pkeyInit_state == libssh2_NB_state_sent3) {
>>>>>         while (1) {
>>>>>             unsigned char *s;
>>>>> +            unsigned char *end;
>>>>>             rc = publickey_packet_receive(session->pkeyInit_pkey,
>>>>>                                           &session->pkeyInit_data,
>>>>>                                           &session->pkeyInit_data_len);
>>>>> @@ -419,6 +422,7 @@ static LIBSSH2_PUBLICKEY *publickey_init(LIBSSH2_SESSION *session)
>>>>>             }
>>>>> 
>>>>>             s = session->pkeyInit_data;
>>>>> +            end = session->pkeyInit_data + session->pkeyInit_data_len;
>>>>>             if ((response =
>>>>>                  publickey_response_id(&s, session->pkeyInit_data_len)) < 0) {
>>>>>                 _libssh2_error(session, LIBSSH2_ERROR_PUBLICKEY_PROTOCOL,
>>>>> @@ -432,19 +436,33 @@ static LIBSSH2_PUBLICKEY *publickey_init(LIBSSH2_SESSION *session)
>>>>>             {
>>>>>                 unsigned long status, descr_len, lang_len;
>>>>> 
>>>>> -                status = _libssh2_ntohu32(s);
>>>>> -                s += 4;
>>>>> -                descr_len = _libssh2_ntohu32(s);
>>>>> -                s += 4;
>>>>> -                /* description starts here */
>>>>> -                s += descr_len;
>>>>> -                lang_len = _libssh2_ntohu32(s);
>>>>> -                s += 4;
>>>>> -                /* lang starts here */
>>>>> -                s += lang_len;
>>>>> -
>>>>> -                if (s >
>>>>> -                    session->pkeyInit_data + session->pkeyInit_data_len) {
>>>>> +                if (4*2 > end - s)
>>>>> +                    s = NULL;
>>>>> +                else {
>>>>> +                    status = _libssh2_ntohu32(s);
>>>>> +                    s += 4;
>>>>> +                    descr_len = _libssh2_ntohu32(s);
>>>>> +                    s += 4;
>>>>> +                    /* description starts here */
>>>>> +                    if (descr_len > (size_t)(end - s))
>>>>> +                        s = NULL;
>>>>> +                    else {
>>>>> +                        s += descr_len;
>>>>> +                        if (4 > end - s)
>>>>> +                            s = NULL;
>>>>> +                        else {
>>>>> +                            lang_len = _libssh2_ntohu32(s);
>>>>> +                            s += 4;
>>>>> +                            /* lang starts here */
>>>>> +                            if (lang_len > (size_t)(end - s))
>>>>> +                                s = NULL;
>>>>> +                else
>>>>> +                                s += lang_len;
>>>>> +                        }
>>>>> +                    }
>>>>> +                }
>>>>> +
>>>>> +                if (s == NULL) {
>>>>>                     _libssh2_error(session,
>>>>>                                    LIBSSH2_ERROR_PUBLICKEY_PROTOCOL,
>>>>>                                    "Malformed publickey subsystem packet");
>>>>> @@ -810,6 +828,7 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>     }
>>>>> 
>>>>>     while (1) {
>>>>> +        unsigned char *end;
>>>>>         rc = publickey_packet_receive(pkey, &pkey->listFetch_data,
>>>>>                                       &pkey->listFetch_data_len);
>>>>>         if (rc == LIBSSH2_ERROR_EAGAIN) {
>>>>> @@ -822,6 +841,7 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>         }
>>>>> 
>>>>>         pkey->listFetch_s = pkey->listFetch_data;
>>>>> +        end = pkey->listFetch_data + pkey->listFetch_data_len;
>>>>>         if ((response =
>>>>>              publickey_response_id(&pkey->listFetch_s,
>>>>>                                    pkey->listFetch_data_len)) < 0) {
>>>>> @@ -836,19 +856,34 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>         {
>>>>>             unsigned long status, descr_len, lang_len;
>>>>> 
>>>>> -            status = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> -            pkey->listFetch_s += 4;
>>>>> -            descr_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> -            pkey->listFetch_s += 4;
>>>>> -            /* description starts at pkey->listFetch_s */
>>>>> -            pkey->listFetch_s += descr_len;
>>>>> -            lang_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> -            pkey->listFetch_s += 4;
>>>>> -            /* lang starts at pkey->listFetch_s */
>>>>> -            pkey->listFetch_s += lang_len;
>>>>> -
>>>>> -            if (pkey->listFetch_s >
>>>>> -                pkey->listFetch_data + pkey->listFetch_data_len) {
>>>>> +            if (4*2 > end - pkey->listFetch_s)
>>>>> +                pkey->listFetch_s = NULL;
>>>>> +            else {
>>>>> +                status = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> +                pkey->listFetch_s += 4;
>>>>> +                descr_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> +                pkey->listFetch_s += 4;
>>>>> +                if (descr_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    pkey->listFetch_s = NULL;
>>>>> +                else {
>>>>> +                    /* description starts at pkey->listFetch_s */
>>>>> +                    pkey->listFetch_s += descr_len;
>>>>> +                    if (4 > end - pkey->listFetch_s)
>>>>> +                        pkey->listFetch_s = NULL;
>>>>> +                    else {
>>>>> +                        lang_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>> +                        pkey->listFetch_s += 4;
>>>>> +                        if (lang_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                            pkey->listFetch_s = NULL;
>>>>> +                        else {
>>>>> +                            /* lang starts at pkey->listFetch_s */
>>>>> +                            pkey->listFetch_s += lang_len;
>>>>> +                        }
>>>>> +                    }
>>>>> +                }
>>>>> +            }
>>>>> +
>>>>> +            if (pkey->listFetch_s == NULL) {
>>>>>                 _libssh2_error(session, LIBSSH2_ERROR_PUBLICKEY_PROTOCOL,
>>>>>                                "Malformed publickey subsystem packet");
>>>>>                 goto err_exit;
>>>>> @@ -887,8 +922,12 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>             if (pkey->version == 1) {
>>>>>                 unsigned long comment_len;
>>>>> 
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 comment_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>> +                if (comment_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    goto err_exit;
>>>>>                 if (comment_len) {
>>>>>                     list[keys].num_attrs = 1;
>>>>>                     list[keys].attrs =
>>>>> @@ -911,24 +950,42 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>                     list[keys].num_attrs = 0;
>>>>>                     list[keys].attrs = NULL;
>>>>>                 }
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 list[keys].name_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>> +                if (list[keys].name_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    goto err_exit;
>>>>>                 list[keys].name = pkey->listFetch_s;
>>>>>                 pkey->listFetch_s += list[keys].name_len;
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 list[keys].blob_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>> +                if (list[keys].blob_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    goto err_exit;
>>>>>                 list[keys].blob = pkey->listFetch_s;
>>>>>                 pkey->listFetch_s += list[keys].blob_len;
>>>>>             } else {
>>>>>                 /* Version == 2 */
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 list[keys].name_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>> +                if (list[keys].name_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    goto err_exit;
>>>>>                 list[keys].name = pkey->listFetch_s;
>>>>>                 pkey->listFetch_s += list[keys].name_len;
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 list[keys].blob_len = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>> +                if (list[keys].blob_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                    goto err_exit;
>>>>>                 list[keys].blob = pkey->listFetch_s;
>>>>>                 pkey->listFetch_s += list[keys].blob_len;
>>>>> +                if (4 > end - pkey->listFetch_s)
>>>>> +                    goto err_exit;
>>>>>                 list[keys].num_attrs = _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                 pkey->listFetch_s += 4;
>>>>>                 if (list[keys].num_attrs) {
>>>>> @@ -943,14 +1000,22 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
>>>>>                         goto err_exit;
>>>>>                     }
>>>>>                     for(i = 0; i < list[keys].num_attrs; i++) {
>>>>> +                        if (4 > end - pkey->listFetch_s)
>>>>> +                            goto err_exit;
>>>>>                         list[keys].attrs[i].name_len =
>>>>>                             _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                         pkey->listFetch_s += 4;
>>>>> +                        if (list[keys].attrs[i].name_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                            goto err_exit;
>>>>>                         list[keys].attrs[i].name = (char *) pkey->listFetch_s;
>>>>>                         pkey->listFetch_s += list[keys].attrs[i].name_len;
>>>>> +                        if (4 > end - pkey->listFetch_s)
>>>>> +                            goto err_exit;
>>>>>                         list[keys].attrs[i].value_len =
>>>>>                             _libssh2_ntohu32(pkey->listFetch_s);
>>>>>                         pkey->listFetch_s += 4;
>>>>> +                        if (list[keys].attrs[i].value_len > (size_t)(end - pkey->listFetch_s))
>>>>> +                            goto err_exit;
>>>>>                         list[keys].attrs[i].value = (char *) pkey->listFetch_s;
>>>>>                         pkey->listFetch_s += list[keys].attrs[i].value_len;
>>>>> 
>>>>> diff --git a/src/session.c b/src/session.c
>>>>> index 06e61dd..ba1bad5 100644
>>>>> --- a/src/session.c
>>>>> +++ b/src/session.c
>>>>> @@ -763,6 +763,7 @@ session_startup(LIBSSH2_SESSION *session, libssh2_socket_t sock)
>>>>>             return rc;
>>>>> 
>>>>>         session->startup_service_length =
>>>>> +            (5 > session->startup_data_len) ? 0 :
>>>>>             _libssh2_ntohu32(session->startup_data + 1);
>>>>> 
>>>>>         if ((session->startup_service_length != (sizeof("ssh-userauth") - 1))
>>>>> @@ -1410,6 +1411,7 @@ libssh2_poll_channel_read(LIBSSH2_CHANNEL *channel, int extended)
>>>>>     packet = _libssh2_list_first(&session->packets);
>>>>> 
>>>>>     while (packet) {
>>>>> +    /* XXX assert(packet->data_len >= 5) XXX */
>>>>>         if ( channel->local.id == _libssh2_ntohu32(packet->data + 1)) {
>>>>>             if ( extended == 1 &&
>>>>>                  (packet->data[0] == SSH_MSG_CHANNEL_EXTENDED_DATA
>>>>> diff --git a/src/sftp.c b/src/sftp.c
>>>>> index c142713..ad38638 100644
>>>>> --- a/src/sftp.c
>>>>> +++ b/src/sftp.c
>>>>> @@ -249,6 +249,7 @@ sftp_packet_add(LIBSSH2_SFTP *sftp, unsigned char *data,
>>>>>                               "Out of sync with the world");
>>>>>     }
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5); XXX */
>>>>>     request_id = _libssh2_ntohu32(&data[1]);
>>>>> 
>>>>>     _libssh2_debug(session, LIBSSH2_TRACE_SFTP, "Received packet id %d",
>>>>> @@ -635,21 +636,25 @@ sftp_attr2bin(unsigned char *p, const LIBSSH2_SFTP_ATTRIBUTES * attrs)
>>>>> 
>>>>> /* sftp_bin2attr
>>>>>  */
>>>>> -static int
>>>>> -sftp_bin2attr(LIBSSH2_SFTP_ATTRIBUTES * attrs, const unsigned char *p)
>>>>> +static const unsigned char *
>>>>> +sftp_bin2attr(LIBSSH2_SFTP_ATTRIBUTES * attrs, const unsigned char *s, const unsigned char *end)
>>>>> {
>>>>> -    const unsigned char *s = p;
>>>>> -
>>>>>     memset(attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
>>>>> +    if (4 < end - p)
>>>>> +        return NULL;
>>>>>     attrs->flags = _libssh2_ntohu32(s);
>>>>>     s += 4;
>>>>> 
>>>>>     if (attrs->flags & LIBSSH2_SFTP_ATTR_SIZE) {
>>>>> +        if (8 < end - p)
>>>>> +            return NULL;
>>>>>         attrs->filesize = _libssh2_ntohu64(s);
>>>>>         s += 8;
>>>>>     }
>>>>> 
>>>>>     if (attrs->flags & LIBSSH2_SFTP_ATTR_UIDGID) {
>>>>> +        if (4*2 < end - p)
>>>>> +            return NULL;
>>>>>         attrs->uid = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>>         attrs->gid = _libssh2_ntohu32(s);
>>>>> @@ -657,18 +662,22 @@ sftp_bin2attr(LIBSSH2_SFTP_ATTRIBUTES * attrs, const unsigned char *p)
>>>>>     }
>>>>> 
>>>>>     if (attrs->flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) {
>>>>> +        if (4 < end - p)
>>>>> +            return NULL;
>>>>>         attrs->permissions = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>>     }
>>>>> 
>>>>>     if (attrs->flags & LIBSSH2_SFTP_ATTR_ACMODTIME) {
>>>>> +        if (4*2 < end - p)
>>>>> +            return NULL;
>>>>>         attrs->atime = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>>         attrs->mtime = _libssh2_ntohu32(s);
>>>>>         s += 4;
>>>>>     }
>>>>> 
>>>>> -    return (s - p);
>>>>> +    return s;
>>>>> }
>>>>> 
>>>>> /* ************
>>>>> @@ -1698,7 +1707,7 @@ static ssize_t sftp_readdir(LIBSSH2_SFTP_HANDLE *handle, char *buffer,
>>>>>             if (attrs)
>>>>>                 memset(attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
>>>>> 
>>>>> -            s += sftp_bin2attr(attrs ? attrs : &attrs_dummy, s);
>>>>> +            s = sftp_bin2attr(attrs ? attrs : &attrs_dummy, s, handle->u.dir.names_end);
>>>>> 
>>>>>             handle->u.dir.next_name = (char *) s;
>>>>>           end:
>>>>> @@ -1789,6 +1798,7 @@ static ssize_t sftp_readdir(LIBSSH2_SFTP_HANDLE *handle, char *buffer,
>>>>> 
>>>>>     handle->u.dir.names_left = num_names;
>>>>>     handle->u.dir.names_packet = data;
>>>>> +    handle->u.dir.names_end = data + data_len;
>>>>>     handle->u.dir.next_name = (char *) data + 9;
>>>>> 
>>>>>     /* use the name popping mechanism from the start of the function */
>>>>> @@ -2252,7 +2262,7 @@ static int sftp_fstat(LIBSSH2_SFTP_HANDLE *handle,
>>>>>         }
>>>>>     }
>>>>> 
>>>>> -    sftp_bin2attr(attrs, data + 5);
>>>>> +    sftp_bin2attr(attrs, data + 5, data + data_len);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>>     return 0;
>>>>> @@ -2559,6 +2569,7 @@ static int sftp_unlink(LIBSSH2_SFTP *sftp, const char *filename,
>>>>> 
>>>>>     sftp->unlink_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     retcode = _libssh2_ntohu32(data + 5);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>> @@ -2669,6 +2680,7 @@ static int sftp_rename(LIBSSH2_SFTP *sftp, const char *source_filename,
>>>>> 
>>>>>     sftp->rename_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     retcode = _libssh2_ntohu32(data + 5);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>> @@ -2793,6 +2805,7 @@ static int sftp_fstatvfs(LIBSSH2_SFTP_HANDLE *handle, LIBSSH2_SFTP_STATVFS *st)
>>>>>                               "Error waiting for FXP EXTENDED REPLY");
>>>>>     }
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     if (data[0] == SSH_FXP_STATUS) {
>>>>>         int retcode = _libssh2_ntohu32(data + 5);
>>>>>         sftp->fstatvfs_state = libssh2_NB_state_idle;
>>>>> @@ -2919,6 +2932,7 @@ static int sftp_statvfs(LIBSSH2_SFTP *sftp, const char *path,
>>>>>                               "Error waiting for FXP EXTENDED REPLY");
>>>>>     }
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     if (data[0] == SSH_FXP_STATUS) {
>>>>>         int retcode = _libssh2_ntohu32(data + 5);
>>>>>         sftp->statvfs_state = libssh2_NB_state_idle;
>>>>> @@ -3051,6 +3065,7 @@ static int sftp_mkdir(LIBSSH2_SFTP *sftp, const char *path,
>>>>> 
>>>>>     sftp->mkdir_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     retcode = _libssh2_ntohu32(data + 5);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>> @@ -3145,6 +3160,7 @@ static int sftp_rmdir(LIBSSH2_SFTP *sftp, const char *path,
>>>>> 
>>>>>     sftp->rmdir_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>>     retcode = _libssh2_ntohu32(data + 5);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>> @@ -3188,6 +3204,7 @@ static int sftp_stat(LIBSSH2_SFTP *sftp, const char *path,
>>>>>         ((stat_type ==
>>>>>           LIBSSH2_SFTP_SETSTAT) ? sftp_attrsize(attrs->flags) : 0);
>>>>>     unsigned char *s, *data;
>>>>> +    unsigned char *data_end;
>>>>>     static const unsigned char stat_responses[2] =
>>>>>         { SSH_FXP_ATTRS, SSH_FXP_STATUS };
>>>>>     int rc;
>>>>> @@ -3258,6 +3275,8 @@ static int sftp_stat(LIBSSH2_SFTP *sftp, const char *path,
>>>>> 
>>>>>     sftp->stat_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>> +
>>>>>     if (data[0] == SSH_FXP_STATUS) {
>>>>>         int retcode;
>>>>> 
>>>>> @@ -3273,7 +3292,7 @@ static int sftp_stat(LIBSSH2_SFTP *sftp, const char *path,
>>>>>     }
>>>>> 
>>>>>     memset(attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
>>>>> -    sftp_bin2attr(attrs, data + 5);
>>>>> +    sftp_bin2attr(attrs, data + 5, data + data_len);
>>>>>     LIBSSH2_FREE(session, data);
>>>>> 
>>>>>     return 0;
>>>>> @@ -3389,6 +3408,8 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
>>>>> 
>>>>>     sftp->symlink_state = libssh2_NB_state_idle;
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4); XXX */
>>>>> +
>>>>>     if (data[0] == SSH_FXP_STATUS) {
>>>>>         int retcode;
>>>>> 
>>>>> @@ -3410,8 +3431,13 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
>>>>>                               "no name entries");
>>>>>     }
>>>>> 
>>>>> +    /* XXX ??? assert(data_len >= 5+4*2); XXX */
>>>>> +
>>>>>     /* this reads a u32 and stores it into a signed 32bit value */
>>>>>     link_len = _libssh2_ntohu32(data + 9);
>>>>> +
>>>>> +    /* XXX ??? assert(data_len-(5+4*2) >= link_len); XXX */
>>>>> +
>>>>>     if (link_len < target_len) {
>>>>>         memcpy(target, data + 13, link_len);
>>>>>         target[link_len] = 0;
>>>>> diff --git a/src/sftp.h b/src/sftp.h
>>>>> index 2ed32ce..91fc0a7 100644
>>>>> --- a/src/sftp.h
>>>>> +++ b/src/sftp.h
>>>>> @@ -122,6 +122,7 @@ struct _LIBSSH2_SFTP_HANDLE
>>>>>             uint32_t names_left;
>>>>>             void *names_packet;
>>>>>             char *next_name;
>>>>> +            char *names_end;
>>>>>         } dir;
>>>>>     } u;
>>>>> 
>>>>> diff --git a/src/userauth.c b/src/userauth.c
>>>>> index cdfa25e..c799a40 100644
>>>>> --- a/src/userauth.c
>>>>> +++ b/src/userauth.c
>>>>> @@ -69,6 +69,7 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
>>>>>        service(14)"ssh-connection" + method_len(4) = 27 */
>>>>>     unsigned long methods_len;
>>>>>     unsigned char *s;
>>>>> +    unsigned char *end;
>>>>>     int rc;
>>>>> 
>>>>>     if (session->userauth_list_state == libssh2_NB_state_idle) {
>>>>> @@ -143,7 +144,18 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
>>>>>             return NULL;
>>>>>         }
>>>>> 
>>>>> +        if (5 > session->userauth_list_data_len) {
>>>>> +            /* XXX ??? XXX */
>>>>> +userauth_packet_overrun:
>>>>> +            LIBSSH2_FREE(session, session->userauth_list_data);
>>>>> +            session->userauth_list_data = NULL;
>>>>> +            session->userauth_list_state = libssh2_NB_state_idle;
>>>>> +            return NULL;
>>>>> +        }
>>>>>         methods_len = _libssh2_ntohu32(session->userauth_list_data + 1);
>>>>> +        if (methods_len > session->userauth_list_data_len - 5) {
>>>>> +            goto userauth_packet_overrun;
>>>>> +        }
>>>>> 
>>>>>         /* Do note that the memory areas overlap! */
>>>>>         memmove(session->userauth_list_data, session->userauth_list_data + 5,
>>>>> @@ -1561,6 +1573,7 @@ userauth_keyboard_interactive(LIBSSH2_SESSION * session,
>>>>>                               LIBSSH2_USERAUTH_KBDINT_RESPONSE_FUNC((*response_callback)))
>>>>> {
>>>>>     unsigned char *s;
>>>>> +    unsigned char *end;
>>>>>     int rc;
>>>>> 
>>>>>     static const unsigned char reply_codes[4] = {
>>>>> @@ -1685,10 +1698,15 @@ userauth_keyboard_interactive(LIBSSH2_SESSION * session,
>>>>> 
>>>>>             /* server requested PAM-like conversation */
>>>>>             s = session->userauth_kybd_data + 1;
>>>>> +            end = session->userauth_kybd_data + session->userauth_kybd_data_len;
>>>>> 
>>>>>             /* string    name (ISO-10646 UTF-8) */
>>>>> +            if (4 > end - s)
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             session->userauth_kybd_auth_name_len = _libssh2_ntohu32(s);
>>>>>             s += 4;
>>>>> +            if (session->userauth_kybd_auth_name_len > (size_t)(end - s))
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             if(session->userauth_kybd_auth_name_len) {
>>>>>                 session->userauth_kybd_auth_name =
>>>>>                     LIBSSH2_ALLOC(session,
>>>>> @@ -1706,8 +1724,12 @@ userauth_keyboard_interactive(LIBSSH2_SESSION * session,
>>>>>             }
>>>>> 
>>>>>             /* string    instruction (ISO-10646 UTF-8) */
>>>>> +            if (4 > end - s)
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             session->userauth_kybd_auth_instruction_len = _libssh2_ntohu32(s);
>>>>>             s += 4;
>>>>> +            if (session->userauth_kybd_auth_instruction_len > (size_t)(end - s))
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             if(session->userauth_kybd_auth_instruction_len) {
>>>>>                 session->userauth_kybd_auth_instruction =
>>>>>                     LIBSSH2_ALLOC(session,
>>>>> @@ -1725,13 +1747,19 @@ userauth_keyboard_interactive(LIBSSH2_SESSION * session,
>>>>>             }
>>>>> 
>>>>>             /* string    language tag (as defined in [RFC-3066]) */
>>>>> +            if (4 > end - s)
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             language_tag_len = _libssh2_ntohu32(s);
>>>>>             s += 4;
>>>>> +            if (language_tag_len > (size_t)(end - s))
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>> 
>>>>>             /* ignoring this field as deprecated */
>>>>>             s += language_tag_len;
>>>>> 
>>>>>             /* int       num-prompts */
>>>>> +            if (4 > end - s)
>>>>> +                goto cleanup; /* XXX ??? XXX */
>>>>>             session->userauth_kybd_num_prompts = _libssh2_ntohu32(s);
>>>>>             s += 4;
>>>>> 
>>>>> @@ -1760,9 +1788,13 @@ userauth_keyboard_interactive(LIBSSH2_SESSION * session,
>>>>> 
>>>>>                 for(i = 0; i < session->userauth_kybd_num_prompts; i++) {
>>>>>                     /* string    prompt[1] (ISO-10646 UTF-8) */
>>>>> +                    if (4 > end - s)
>>>>> +                        goto cleanup; /* XXX ??? XXX */
>>>>>                     session->userauth_kybd_prompts[i].length =
>>>>>                         _libssh2_ntohu32(s);
>>>>>                     s += 4;
>>>>> +                    if (session->userauth_kybd_prompts[i].length > (size_t)(end - s))
>>>>> +                        goto cleanup; /* XXX ??? XXX */
>>>>>                     session->userauth_kybd_prompts[i].text =
>>>>>                         LIBSSH2_CALLOC(session,
>>>>>                                        session->userauth_kybd_prompts[i].length);
_______________________________________________
libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel

From libssh2-devel-bounces@cool.haxx.se  Wed Apr  3 23:07:48 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x33L7Rbm003167;
	Wed, 3 Apr 2019 23:07:45 +0200
Received: from mail.panic.com (mail.panic.com [38.103.165.36])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x33L7OhQ003131
 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Wed, 3 Apr 2019 23:07:25 +0200
Received: from [10.0.0.249] (unknown [10.0.0.249])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mail.panic.com (Postfix) with ESMTPSA id 376C931C
 for <libssh2-devel@cool.haxx.se>; Wed,  3 Apr 2019 14:07:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=panic.com; s=dkim;
 t=1554325639; bh=b4k9jVXNAF+Wsrj4Kbco8SitDZCV/FL+PavNk2Jm580=;
 h=From:Subject:Date:References:To:In-Reply-To;
 b=shQIRZ7QoFq2yoby6hX59SSRonZrAsGk/qZG+oFwzVNqJLd3gyV5ZC+IKGVIbYB1O
 HxSnLyxBwVo7CYtPvGYAmIDlT4W4KSXgKHbVOHCPUjOdyIuop95n71W455TLcyH2BP
 ex5nQxYILxk1KyRX8NYcaNEMimGM21NEJwHO1s3Q=
From: Will Cosgrove <will@panic.com>
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\))
Subject: Re: [PATCH][WIP][v2] Fix out-of-buffer-boundary reads
Date: Wed, 3 Apr 2019 14:07:19 -0700
References: <CAD9rwMoHmS0_WoAP-=M6WXG_DherCgDWeyBrEGO8-99yq5d70g@mail.gmail.com>
 <m3vb5bmq6j.fsf@gmail.com> <m3a8lju3e3.fsf@gmail.com>
 <alpine.DEB.2.20.1903182209050.22468@tvnag.unkk.fr>
 <8cc68255-11c0-5800-dfcc-d5da595d8874@gmail.com>
 <d72bc4be-28c3-6405-7780-e6392e032a5e@gmail.com>
 <7DF9FA2F-FAF8-478E-B56B-4D8C04688FBF@panic.com>
 <40269726-fef3-2a21-5ef8-724ef0af7ea6@gmail.com>
To: libssh2 development <libssh2-devel@cool.haxx.se>
In-Reply-To: <40269726-fef3-2a21-5ef8-724ef0af7ea6@gmail.com>
Message-Id: <CC4748C0-9988-4B4F-99C1-81D43C40FBB8@panic.com>
X-Mailer: Apple Mail (2.3445.104.8)
X-MIME-Autoconverted: from quoted-printable to 8bit by giant.haxx.se id
 x33L7OhQ003131
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: text/plain; charset="utf-8"
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by giant.haxx.se id x33L7Rbm003167

>> The 1.8.x branch fixes only resolves the issues brought up by the
>> Conicanal review while master contains a more exhaustive review and is
>> highly recommended to use.
> 
> Stable distro won't use git master. You can say it is "downstream
> problem", but it won't change the end result: either upstream provides
> backport(ed|able) security fixes for few previous branches, or most of
> end users will use vulnerable code for years.
> 
> And fixes in libssh2 git master are not backportable, 1.8.x branch is.

Yup, I agree. The plain fact of the matter is there isn’t enough man power/interest to provide back-ported fixes for all the issues addressed on master. The plan is to release 1.9.0 on the 11th. I know that doesn’t help prior releases, but it does get the ball moving in the right direction.

>> I will submit a patch on Monday for the check length function, thanks
>> for bringing that to our attention.
> 
> Not sure if it is still possible to practically exploit it (as of
> c07bc647f), but those (int) casts are wrong (and unneeded).
> 
> Anyway, /proper/ check is:
> 
> -    if(len > buf->len)
> -        return 0;
> -
> -    return ((int)(buf->dataptr - buf->data) <= (int)(buf->len - len)) ? 1 : 0;
> +    return len <= (size_t)((buf->data + buf->len) - buf->dataptr);

This is a better fix, thanks.

Regards,

Will


_______________________________________________
libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel

From libssh2-devel-bounces@cool.haxx.se  Thu Apr  4 12:24:07 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x34ANQnX024388;
	Thu, 4 Apr 2019 12:23:55 +0200
Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com
 [IPv6:2607:f8b0:4864:20:0:0:0:b35])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x34ANOBD023948
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Thu, 4 Apr 2019 12:23:25 +0200
Received: by mail-yb1-xb35.google.com with SMTP id c2so799160ybn.1
 for <libssh2-devel@cool.haxx.se>; Thu, 04 Apr 2019 03:23:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:from:date:message-id:subject:to;
 bh=frL7A5LPur//7qRPcted4NdssT7lAHrv04TAn4NUSKk=;
 b=Vd3dEvCdLUqJtd7lQhDnBSglIUZW9/HbcGH2Lkpe0JHNpRVB0j51EDzkTGS5RSOyAv
 isObp0w6EoJTmChbF6LBpXok8MXtyablaFKVXMseXtZXfU2i4NQ0EHm8NvHm3IIdna4Q
 75S2G3Kb8im3odJ48u/2fr4/TJpTh2T6L6vgBl66gIhKHvnl8CHQSXtdXhszjSOjK3v+
 gAQofKc3I5/8CyhnY4quKyVYLTK7UIDzoFlokLtINgb0/O5IpOBeEVvVy18vqaAgF56m
 lwOxAPxr/BZgAToLRZS6djXddVhDlUMX0tqMLK7E4f1QIN1AEEAruNxYyoNTd59Jrois
 SoTg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
 bh=frL7A5LPur//7qRPcted4NdssT7lAHrv04TAn4NUSKk=;
 b=GyTWaCUyajI0tVHRryPLuPjdRBcfdRQhr8O7Rz6WvbmPsSPVfsji+rn5OUj7/WZvqw
 8wNTlsSHA2dr/fPG+LVATIq9zBZQ/1r9hTgHBZyHedb8AljmHGphIBd9GPfNREwPehH8
 pgkg5Z8fzJHDDAZG90Jq5J15oZhlEMtk7BvcfLrE5QOaOjyNn4gjp8pXCSE9eNVIwzB+
 6IIZb04Vz9FrXe9yl52gk/XbLbD83cmPr1P++e2QufucGtNRvhv7987or9+rH5Hb7wW1
 PORHYYuhLlbbWdOyxUEZLWEOkMu0In96MIyQg6ROqgzvXVT1eB2JlrsAVFsUorlNfIXD
 NY2w==
X-Gm-Message-State: APjAAAXvWG8sD6TabMXvpyarwLCkKePdl2EQycuOZRU4NQIglRaqfN+W
 KcI8AliLayWlZbu9tfK9Zn25zMh7hR2K/vNUkvycg9bu
X-Google-Smtp-Source: APXvYqxRSAnCmk3/K8ospe/MyTJi/+ZWCd63Mjho4puEb6c7q2gKTwViSTyxSsVn6BvLveqU37HM4rwL0EOhT/Migek=
X-Received: by 2002:a25:585:: with SMTP id 127mr4528813ybf.60.1554373399162;
 Thu, 04 Apr 2019 03:23:19 -0700 (PDT)
MIME-Version: 1.0
From: Mayur Kankanwadi <eminemence@gmail.com>
Date: Thu, 4 Apr 2019 15:53:03 +0530
Message-ID: <CAKCwhcw6ffux-Fx+RAwPFxd3rq+hB=RspyOgWPNqOuC7eQ9qXQ@mail.gmail.com>
Subject: Keyboard-interactive callback not being called.
To: libssh2-devel@cool.haxx.se
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: multipart/mixed; boundary="===============0214411823=="
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>

--===============0214411823==
Content-Type: multipart/alternative; boundary="0000000000004e34650585b1c2d7"

--0000000000004e34650585b1c2d7
Content-Type: text/plain; charset="UTF-8"

Hi,
I am using the windows port of libssh2 v1.8.0 for setting ssh sessions to
linux and mac hosts.
I have now started adding code to figure out the authentication methods and
then performing relevant actions. So my code looks something like this :
---
for (std::string authMethod : *authMethodsList) {
if (authMethod.compare("password") == 0) {
if (libssh2_userauth_password(mSshSession, usr, passwd)) {
authStatus = false;
}
else {
authStatus = true;
break;
}
}
else if (authMethod.compare("publickey") == 0) {
// TODO auth!!
}
else if (authMethod.compare("keyboard-interactive") == 0) {
// set the password in the session
//
char* localPass = _strdup(passwd);
void **sessionAbstract = libssh2_session_abstract(mSshSession);
*sessionAbstract = localPass;
if (libssh2_userauth_keyboard_interactive(mSshSession, usr, &kbd_callback))
{
authStatus = false;
free(localPass);
}
else {
authStatus = true;
free(localPass);
break;
}
}
}
---
Now there are two issues here :
1. While processing "password" method, the method sometimes fails with
authentication failure error. This happens when the same username password
works perfectly using other ssh clients.
2. Processing "keyboard-interactive" method, the response
callback(kbd_callback) passed to libssh2_userauth_keyboard_interactive() is
never called. The error message seen in this case is "Waiting for keyboard
USERAUTH response".

Can someone provide pointers as to how to resolve the above two issues?

Thanks in advance.
--eminemence.

-------
flaminghorns.com - Coding, mobile apps and much more..
<http://flaminghorns.com>
-------

--0000000000004e34650585b1c2d7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_defa=
ult" style=3D"font-family:&quot;trebuchet ms&quot;,sans-serif">Hi,</div><di=
v class=3D"gmail_default" style=3D"font-family:&quot;trebuchet ms&quot;,san=
s-serif">I am using the windows port of libssh2 v1.8.0 for setting ssh sess=
ions to linux and mac hosts.</div><div class=3D"gmail_default" style=3D"fon=
t-family:&quot;trebuchet ms&quot;,sans-serif">I have now started adding cod=
e to figure out the authentication methods and then performing relevant act=
ions. So my code looks something like this :=C2=A0</div><div class=3D"gmail=
_default" style=3D"font-family:&quot;trebuchet ms&quot;,sans-serif">---</di=
v><div class=3D"gmail_default" style=3D"font-family:&quot;trebuchet ms&quot=
;,sans-serif"><div class=3D"gmail_default">for (std::string authMethod : *a=
uthMethodsList) {</div><div class=3D"gmail_default"><span style=3D"white-sp=
ace:pre">	</span>if (authMethod.compare(&quot;password&quot;) =3D=3D 0) {</=
div><div class=3D"gmail_default"><span style=3D"white-space:pre">		</span>i=
f (libssh2_userauth_password(mSshSession, usr, passwd)) {</div><div class=
=3D"gmail_default"><span style=3D"white-space:pre">			</span>authStatus =3D=
 false;</div><div class=3D"gmail_default"><span style=3D"white-space:pre">	=
	</span>}</div><div class=3D"gmail_default"><span style=3D"white-space:pre"=
>		</span>else {</div><div class=3D"gmail_default"><span style=3D"white-spa=
ce:pre">			</span>authStatus =3D true;</div><div class=3D"gmail_default"><s=
pan style=3D"white-space:pre">			</span>break;</div><div class=3D"gmail_def=
ault"><span style=3D"white-space:pre">		</span>}</div><div class=3D"gmail_d=
efault"><span style=3D"white-space:pre">	</span>}</div><div class=3D"gmail_=
default"><span style=3D"white-space:pre">	</span>else if (authMethod.compar=
e(&quot;publickey&quot;) =3D=3D 0) {</div><div class=3D"gmail_default"><spa=
n style=3D"white-space:pre">		</span>// TODO auth!!</div><div class=3D"gmai=
l_default"><span style=3D"white-space:pre">	</span>}</div><div class=3D"gma=
il_default"><span style=3D"white-space:pre">	</span>else if (authMethod.com=
pare(&quot;keyboard-interactive&quot;) =3D=3D 0) {</div><div class=3D"gmail=
_default"><span style=3D"white-space:pre">		</span>// set the password in t=
he session</div><div class=3D"gmail_default"><span style=3D"white-space:pre=
">		</span>//=C2=A0</div><div class=3D"gmail_default"><span style=3D"white-=
space:pre">		</span>char* localPass =3D _strdup(passwd);</div><div class=3D=
"gmail_default"><span style=3D"white-space:pre">		</span>void **sessionAbst=
ract =3D libssh2_session_abstract(mSshSession);</div><div class=3D"gmail_de=
fault"><span style=3D"white-space:pre">		</span>*sessionAbstract =3D localP=
ass;</div><div class=3D"gmail_default"><span style=3D"white-space:pre">		</=
span></div><div class=3D"gmail_default"><span style=3D"white-space:pre">		<=
/span>if (libssh2_userauth_keyboard_interactive(mSshSession, usr, &amp;kbd_=
callback)) {</div><div class=3D"gmail_default"><span style=3D"white-space:p=
re">			</span>authStatus =3D false;</div><div class=3D"gmail_default"><span=
 style=3D"white-space:pre">			</span>free(localPass);</div><div class=3D"gm=
ail_default"><span style=3D"white-space:pre">		</span>}</div><div class=3D"=
gmail_default"><span style=3D"white-space:pre">		</span>else {</div><div cl=
ass=3D"gmail_default"><span style=3D"white-space:pre">			</span>authStatus =
=3D true;</div><div class=3D"gmail_default"><span style=3D"white-space:pre"=
>			</span>free(localPass);</div><div class=3D"gmail_default"><span style=
=3D"white-space:pre">			</span>break;</div><div class=3D"gmail_default"><sp=
an style=3D"white-space:pre">		</span>}</div><div class=3D"gmail_default"><=
span style=3D"white-space:pre">	</span>}</div><div class=3D"gmail_default">=
}</div><div class=3D"gmail_default">---</div><div class=3D"gmail_default">N=
ow there are two issues here :=C2=A0</div><div class=3D"gmail_default">1. W=
hile processing &quot;password&quot; method, the method sometimes fails wit=
h authentication failure error. This happens when the same username passwor=
d works perfectly using other ssh clients.</div><div class=3D"gmail_default=
">2. Processing &quot;keyboard-interactive&quot; method, the response callb=
ack(kbd_callback) passed to libssh2_userauth_keyboard_interactive() is neve=
r called. The error message seen in this case is &quot;Waiting for keyboard=
 USERAUTH response&quot;.</div><div class=3D"gmail_default"><br></div><div =
class=3D"gmail_default">Can someone provide pointers as to how to resolve t=
he above two issues?=C2=A0</div></div><div><div dir=3D"ltr" class=3D"gmail_=
signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br=
></div><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:&=
quot;trebuchet ms&quot;,sans-serif">Thanks in advance.</div><div class=3D"g=
mail_default" style=3D"font-family:&quot;trebuchet ms&quot;,sans-serif">--e=
minemence.</div><br></div><div dir=3D"ltr">-------</div><div dir=3D"ltr"><f=
ont face=3D"monospace, monospace" color=3D"#ff0000"><a href=3D"http://flami=
nghorns.com" target=3D"_blank">flaminghorns.com - Coding, mobile apps and m=
uch more..</a></font></div><div dir=3D"ltr">-------</div></div></div></div>=
</div></div></div></div></div></div>

--0000000000004e34650585b1c2d7--

--===============0214411823==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--===============0214411823==--

From libssh2-devel-bounces@cool.haxx.se  Thu Apr  4 22:01:00 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x34K0MLf013511;
	Thu, 4 Apr 2019 22:00:50 +0200
Received: from newmailgate.tditx.com (mailgate.tditx.com [65.197.74.140])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x34K0J6F013354
 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Thu, 4 Apr 2019 22:00:20 +0200
From: "Engstrom, John" <john.engstrom@tditechnologies.com>
To: libssh2 development <libssh2-devel@cool.haxx.se>
Date: Thu, 4 Apr 2019 15:00:12 -0500
Subject: Re: Ship a 1.9.0 asap
Thread-Topic: Ship a 1.9.0 asap
Thread-Index: AdTrIQOGV374IIfJS0GsQryGzRSt8A==
Message-ID: <824E51B0-8415-4CD6-AC45-766E099ECFAC@tditechnologies.com>
References: <alpine.DEB.2.20.1903201530170.2206@tvnag.unkk.fr>
 <alpine.DEB.2.20.1903240015190.17012@tvnag.unkk.fr>
In-Reply-To: <alpine.DEB.2.20.1903240015190.17012@tvnag.unkk.fr>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
MIME-Version: 1.0
X-MIME-Autoconverted: from base64 to 8bit by giant.haxx.se id x34K0J6F013354
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Content-Type: text/plain; charset="utf-8"
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by giant.haxx.se id x34K0MLf013511

We’re having discussions of whether to include 1.8.2or 1.9.0 in our next product release.

What level of confidence is there in an April 11 release date for 1.9.0?

- John Engstrom

> On Mar 23, 2019, at 6:22 PM, Daniel Stenberg <daniel@haxx.se> wrote:
> 
>> On Wed, 20 Mar 2019, Daniel Stenberg wrote:
>> 
>> My second alternative is April 11.
> 
> I don't think we're ready yet (and nobody else has said anything) so I'm 
> now aiming for a release on April 11.
> 
> Please help us out with tests, fixes and code reviews.
> 
> -- 
> 
>  / daniel.haxx.se
> _______________________________________________
> libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel

_______________________________________________
libssh2-devel https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel

From libssh2-devel-bounces@cool.haxx.se  Thu Apr  4 23:19:41 2019
Return-Path: <libssh2-devel-bounces@cool.haxx.se>
Received: from www.haxx.se (mail [127.0.0.1])
	by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTP id x34LJ7s9025033;
	Thu, 4 Apr 2019 23:19:33 +0200
Received: from giant.haxx.se (mail [127.0.0.1])
 by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x34LJ6vV025027
 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
 for <libssh2-devel@cool.haxx.se>; Thu, 4 Apr 2019 23:19:06 +0200
Received: from localhost (dast@localhost)
 by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x34LJ6XT025023
 for <libssh2-devel@cool.haxx.se>; Thu, 4 Apr 2019 23:19:06 +0200
X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs
Date: Thu, 4 Apr 2019 23:19:06 +0200 (CEST)
From: Daniel Stenberg <daniel@haxx.se>
X-X-Sender: dast@giant.haxx.se
To: libssh2 development <libssh2-devel@cool.haxx.se>
Subject: Re: Ship a 1.9.0 asap
In-Reply-To: <824E51B0-8415-4CD6-AC45-766E099ECFAC@tditechnologies.com>
Message-ID: <alpine.DEB.2.20.1904042318170.20538@tvnag.unkk.fr>
References: <alpine.DEB.2.20.1903201530170.2206@tvnag.unkk.fr>
 <alpine.DEB.2.20.1903240015190.17012@tvnag.unkk.fr>
 <824E51B0-8415-4CD6-AC45-766E099ECFAC@tditechnologies.com>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
X-fromdanielhimself: yes
MIME-Version: 1.0
Content-Type: multipart/mixed;
 BOUNDARY="1129329158-1021855809-1554412746=:20538"
X-BeenThere: libssh2-devel@cool.haxx.se
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: libssh2 development <libssh2-devel.cool.haxx.se>
List-Unsubscribe: <https://cool.haxx.se/cgi-bin/mailman/options/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=unsubscribe>
List-Archive: <http://cool.haxx.se/pipermail/libssh2-devel/>
List-Post: <mailto:libssh2-devel@cool.haxx.se>
List-Help: <mailto:libssh2-devel-request@cool.haxx.se?subject=help>
List-Subscribe: <https://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel>, 
 <mailto:libssh2-devel-request@cool.haxx.se?subject=subscribe>
Reply-To: libssh2 development <libssh2-devel@cool.haxx.se>
Errors-To: libssh2-devel-bounces@cool.haxx.se
Sender: "libssh2-devel" <libssh2-devel-bounces@cool.haxx.se>

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--1129329158-1021855809-1554412746=:20538
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8BIT

On Thu, 4 Apr 2019, Engstrom, John wrote:

> We’re having discussions of whether to include 1.8.2or 1.9.0 in our next 
> product release.
>
> What level of confidence is there in an April 11 release date for 1.9.0?

Low confidence level. But hopefully the date won't slip too much... :-/

-- 

  / daniel.haxx.se
--1129329158-1021855809-1554412746=:20538
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGlic3NoMi1k
ZXZlbCBodHRwczovL2Nvb2wuaGF4eC5zZS9jZ2ktYmluL21haWxtYW4vbGlzdGluZm8vbGlic3No
Mi1kZXZlbAo=

--1129329158-1021855809-1554412746=:20538--

