openssh: fix CVE-2025-61985

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI,
potentially leading to code execution when a ProxyCommand is used.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61985

Upstream patch:
https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0

(From OE-Core rev: 52d925423b826383d12a97b834475ab5699fd492)

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2 files changed, 48 insertions, 0 deletions

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch
new file mode 100644
index 0000000000..9f4de0ed56
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch
@@ -0,0 +1,47 @@
+From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 4 Sep 2025 00:30:06 +0000
+Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Suggested by David Leadbeater, ok deraadt@
+
+OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c
+
+Upstream-Status: Backport [Upstream commit https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0]
+CVE: CVE-2025-61985
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ misc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/misc.c b/misc.c
+index 3db2e4d0b..cac246b63 100644
+--- a/misc.c
++++ b/misc.c
+@@ -955,7 +955,7 @@ urldecode(const char *src)
+        size_t srclen;
+ 
+        if ((srclen = strlen(src)) >= SIZE_MAX)
+-               fatal_f("input too large");
++               return NULL;
+        ret = xmalloc(srclen + 1);
+        for (dst = ret; *src != '\0'; src++) {
+                switch (*src) {
+@@ -963,9 +963,10 @@ urldecode(const char *src)
+                        *dst++ = ' ';
+                        break;
+                case '%':
++                       /* note: don't allow \0 characters */
+                        if (!isxdigit((unsigned char)src[1]) ||
+                            !isxdigit((unsigned char)src[2]) ||
+-                           (ch = hexchar(src + 1)) == -1) {
++                           (ch = hexchar(src + 1)) == -1 || ch == 0) {
+                                free(ret);
+                                return NULL;
+                        }
+-- 
+2.44.1
+
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index afcd50c7e6..bdb8a1599b 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -32,6 +32,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2025-26466.patch \
            file://CVE-2025-26465.patch \
            file://CVE-2025-32728.patch \
+           file://CVE-2025-61985.patch \
            "
 SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"