From 6ba5ff1b7b1547a59f750fbc06b89737b7456117 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Thu, 8 Jan 2026 12:09:50 +0100 Subject: [PATCH] CVE-2026-0966 misc: Avoid heap buffer underflow in ssh_get_hexa Signed-off-by: Jakub Jelen Reviewed-by: Pavol Žáčik (cherry picked from commit 417a095e6749a1f3635e02332061edad3c6a3401) ssh_get_hexa function not present in misc.c. It was in dh.c file in older libssh versions. ssh_get_hexa function moved from dh.c from misc.c by the below commit https://git.libssh.org/projects/libssh.git/commit/?id=43a4f86b6e14a907b3a298d10d5cd7efb59f6a09 Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=6ba5ff1b7b1547a59f750fbc06b89737b7456117] CVE: CVE-2026-0966 Signed-off-by: Vijay Anusuri --- src/dh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/dh.c b/src/dh.c index 7116d1dc..321aeba6 100644 --- a/src/dh.c +++ b/src/dh.c @@ -1486,7 +1486,7 @@ char *ssh_get_hexa(const unsigned char *what, size_t len) { size_t i; size_t hlen = len * 3; - if (len > (UINT_MAX - 1) / 3) { + if (what == NULL || len < 1 || len > (UINT_MAX - 1) / 3) { return NULL; } -- 2.25.1