search

wolfSSL / wolfssh

wolfSSH is a small, fast, portable SSH implementation, including support for SCP and SFTP.
https://www.wolfssl.com
367 stars 88 forks source link

DoReiceive() does not update the input buffer after DoPacket(), when it has to. #621

Closed falemagn closed 9 months ago

falemagn commented 9 months ago

In internal.c, DoPacket() updates the input buffer's index unless WS_OVERFLOW_E or WS_BUFFER_E are returned: https://github.com/wolfSSL/wolfssh/blob/ec5a9560a4d19d8774b17bef2b84549a8ad866ff/src/internal.c#L7697

DoReceive() should consequently update its part of the input buffer's size - the mac size - in all the cases in which DoPacket() updates the buffer's index too. But because it returns early in the cases in which DoPacket() returns certain errors, even though DoPacket() does update the buffer in those cases, it happens that the buffer gets misaligned.

In certain situations not easy to reproduce, this can lead to WS_OVERFLOW_E being returned or even crashes.

ejohnstown commented 9 months ago

Good catch.