Browse Source

Fix: panic on malformed SSH packet

- validation allowed packet_length 0, which resulted
  in panic in call to bytes.(*Buffer).Grow with input
  n of -1

- packet_length includes padding_length byte, so
  must be at least 1
  (https://tools.ietf.org/html/rfc4253#section-6)
Rod Hynes 8 years ago
parent
commit
0530713913
1 changed files with 1 additions and 1 deletions
  1. 1 1
      psiphon/common/obfuscatedSshConn.go

+ 1 - 1
psiphon/common/obfuscatedSshConn.go

@@ -570,7 +570,7 @@ func getSshPacketPrefix(buffer []byte) (int, int, int, int, error) {
 
 	packetLength := int(binary.BigEndian.Uint32(buffer[0 : SSH_PACKET_PREFIX_LENGTH-1]))
 
-	if packetLength < 0 || packetLength > SSH_MAX_PACKET_LENGTH {
+	if packetLength < 1 || packetLength > SSH_MAX_PACKET_LENGTH {
 		return 0, 0, 0, 0, ContextError(errors.New("invalid ssh packet length"))
 	}