From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Thu, 4 Sep 2025 00:30:06 +0000 Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suggested by David Leadbeater, ok deraadt@ OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c Upstream-Status: Backport [Upstream commit https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0] CVE: CVE-2025-61985 Signed-off-by: David Nyström --- misc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/misc.c b/misc.c index 3db2e4d0b..cac246b63 100644 --- a/misc.c +++ b/misc.c @@ -955,7 +955,7 @@ urldecode(const char *src) size_t srclen; if ((srclen = strlen(src)) >= SIZE_MAX) - fatal_f("input too large"); + return NULL; ret = xmalloc(srclen + 1); for (dst = ret; *src != '\0'; src++) { switch (*src) { @@ -963,9 +963,10 @@ urldecode(const char *src) *dst++ = ' '; break; case '%': + /* note: don't allow \0 characters */ if (!isxdigit((unsigned char)src[1]) || !isxdigit((unsigned char)src[2]) || - (ch = hexchar(src + 1)) == -1) { + (ch = hexchar(src + 1)) == -1 || ch == 0) { free(ret); return NULL; } -- 2.44.1