Robert Hensing 927bee3692 libgit2: fix heap buffer overflow in SSH custom credential handling ...

The ssh_custom_free() function was calling strlen() on binary public key
data, causing a heap buffer overflow when the data wasn't null-terminated.
It also caused keys with null bytes in them to be not cleared completely.
This patch uses the stored publickey_len field instead of strlen() to
determine the correct buffer size for zeroing memory.

This fix has been published in https://github.com/libgit2/libgit2/pull/7146

Nix uses libgit2, but not the libssh2 integration. Other applications may be
affected, and need this fix.

2025-10-15 22:57:18 +02:00

1.3 KiB

Raw Permalink Blame History

View Raw