From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Thu, 4 Sep 2025 00:30:06 +0000 Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings. Suggested by David Leadbeater, ok deraadt@ OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c CVE: CVE-2025-61985 Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0] Signed-off-by: Archana Polampalli --- misc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/misc.c b/misc.c index 6135b15..3d133b5 100644 --- a/misc.c +++ b/misc.c @@ -934,9 +934,10 @@ urldecode(const char *src) *dst++ = ' '; break; case '%': + /* note: don't allow \0 characters */ if (!isxdigit((unsigned char)src[1]) || !isxdigit((unsigned char)src[2]) || - (ch = hexchar(src + 1)) == -1) { + (ch = hexchar(src + 1)) == -1 || ch == 0) { free(ret); return NULL; } -- 2.40.0