From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 4 Sep 2025 00:30:06 +0000
Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings.
 Suggested by David Leadbeater, ok deraadt@

OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c

CVE: CVE-2025-61985

Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0]

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
 misc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/misc.c b/misc.c
index 6135b15..3d133b5 100644
--- a/misc.c
+++ b/misc.c
@@ -934,9 +934,10 @@ urldecode(const char *src)
			*dst++ = ' ';
			break;
		case '%':
+			/* note: don't allow \0 characters */
			if (!isxdigit((unsigned char)src[1]) ||
			    !isxdigit((unsigned char)src[2]) ||
-			    (ch = hexchar(src + 1)) == -1) {
+			    (ch = hexchar(src + 1)) == -1 || ch == 0) {
				free(ret);
				return NULL;
			}
--
2.40.0
