Sanitize padding_length - _libssh2_transport_read().
This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.
@@ -445,6 +445,10 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
}
p->padding_length = block[4];
+ if ( p->padding_length > p->packet_length - 1 ) {
+ return LIBSSH2_ERROR_DECRYPT;
+ }
+
/* total_num is the number of bytes following the initial
(5 bytes) packet length and padding length fields */
