libssh2: Backport fix for CVE-2020-22218

Bug: https://github.com/libssh2/libssh2/pull/476

Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45
&
https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

2 files changed, 40 insertions, 0 deletions

diff --git a/meta-oe/recipes-support/libssh2/files/CVE-2020-22218.patch b/meta-oe/recipes-support/libssh2/files/CVE-2020-22218.patch
new file mode 100644
index 000000000..49dbde737
--- /dev/null
+++ b/meta-oe/recipes-support/libssh2/files/CVE-2020-22218.patch
@@ -0,0 +1,39 @@
+From 642eec48ff3adfdb7a9e562b6d7fc865d1733f45 Mon Sep 17 00:00:00 2001
+From: lutianxiong <lutianxiong@huawei.com>
+Date: Fri, 29 May 2020 01:25:40 +0800
+Subject: [PATCH] transport.c: fix use-of-uninitialized-value (#476)
+
+file:transport.c
+
+notes:
+return error if malloc(0)
+
+credit:
+lutianxiong
+
+Bug: https://github.com/libssh2/libssh2/pull/476
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45
+&
+https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df]
+CVE: CVE-2020-22218
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index 45e445c..35e7df3 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -465,7 +465,7 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
+              * or less (including length, padding length, payload,
+              * padding, and MAC.)."
+              */
+-            if(total_num > LIBSSH2_PACKET_MAXPAYLOAD) {
++            if(total_num > LIBSSH2_PACKET_MAXPAYLOAD || total_num == 0) {
+                 return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+             }
+ 
+-- 
+2.25.1
+
diff --git a/meta-oe/recipes-support/libssh2/libssh2_1.9.0.bb b/meta-oe/recipes-support/libssh2/libssh2_1.9.0.bb
index c1f337a44..e11e66376 100644
--- a/meta-oe/recipes-support/libssh2/libssh2_1.9.0.bb
+++ b/meta-oe/recipes-support/libssh2/libssh2_1.9.0.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=c5cf34fc0acb44b082ef50ef5e4354ca"
 
 SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
            file://CVE-2019-17498.patch \
+           file://CVE-2020-22218.patch \
 "
 SRC_URI[md5sum] = "1beefafe8963982adc84b408b2959927"
 SRC_URI[sha256sum] = "d5fb8bd563305fd1074dda90bd053fb2d29fc4bce048d182f96eaa466dfadafd"