francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
137 lines
4.4 KiB
Diff
137 lines
4.4 KiB
Diff
From 04cd54c7302195055d208e0ca00d6e519d674bb2 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Mon, 22 Dec 2025 21:00:03 +0100
|
|
Subject: [PATCH] CVE-2026-0968 tests: Reproducer for invalid longname data
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
|
|
(cherry picked from commit 90a5d8f47399e8db61b56793cd21476ff6a528e0)
|
|
(cherry picked from commit 212121971fb26e1e00b72bd5402c0454a4d84c03)
|
|
|
|
CVE: CVE-2026-0968
|
|
Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03]
|
|
|
|
Certain functions from sftp.c were moved to a new file sftp_common.c
|
|
in version 0.11.0 by following commit:
|
|
https://git.libssh.org/projects/libssh.git/commit/src/sftp_common.c?id=c3e03ab4651e4f3382e3a51c0273ade894f0c48a
|
|
|
|
Updated unit test to include sftp.c during the backport.
|
|
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
tests/unittests/CMakeLists.txt | 7 +++
|
|
tests/unittests/torture_unit_sftp.c | 86 +++++++++++++++++++++++++++++
|
|
2 files changed, 93 insertions(+)
|
|
create mode 100644 tests/unittests/torture_unit_sftp.c
|
|
|
|
diff --git a/tests/unittests/CMakeLists.txt b/tests/unittests/CMakeLists.txt
|
|
index f85da72b..41f25830 100644
|
|
--- a/tests/unittests/CMakeLists.txt
|
|
+++ b/tests/unittests/CMakeLists.txt
|
|
@@ -101,6 +101,13 @@ if (UNIX AND NOT WIN32)
|
|
endif (WITH_SERVER)
|
|
endif (UNIX AND NOT WIN32)
|
|
|
|
+if (WITH_SFTP)
|
|
+ set(LIBSSH_UNIT_TESTS
|
|
+ ${LIBSSH_UNIT_TESTS}
|
|
+ torture_unit_sftp
|
|
+ )
|
|
+endif (WITH_SFTP)
|
|
+
|
|
foreach(_UNIT_TEST ${LIBSSH_UNIT_TESTS})
|
|
add_cmocka_test(${_UNIT_TEST}
|
|
SOURCES ${_UNIT_TEST}.c
|
|
diff --git a/tests/unittests/torture_unit_sftp.c b/tests/unittests/torture_unit_sftp.c
|
|
new file mode 100644
|
|
index 00000000..8cdaba8e
|
|
--- /dev/null
|
|
+++ b/tests/unittests/torture_unit_sftp.c
|
|
@@ -0,0 +1,86 @@
|
|
+#include "config.h"
|
|
+
|
|
+#include "sftp.c"
|
|
+#include "torture.h"
|
|
+
|
|
+#define LIBSSH_STATIC
|
|
+
|
|
+static void test_sftp_parse_longname(void **state)
|
|
+{
|
|
+ const char *lname = NULL;
|
|
+ char *value = NULL;
|
|
+
|
|
+ /* state not used */
|
|
+ (void)state;
|
|
+
|
|
+ /* Valid example from SFTP draft, page 18:
|
|
+ * https://datatracker.ietf.org/doc/draft-spaghetti-sshm-filexfer/
|
|
+ */
|
|
+ lname = "-rwxr-xr-x 1 mjos staff 348911 Mar 25 14:29 t-filexfer";
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
|
|
+ assert_string_equal(value, "-rwxr-xr-x");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_OWNER);
|
|
+ assert_string_equal(value, "mjos");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_GROUP);
|
|
+ assert_string_equal(value, "staff");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_SIZE);
|
|
+ assert_string_equal(value, "348911");
|
|
+ free(value);
|
|
+ /* This function is broken further as the date contains space which breaks
|
|
+ * the parsing altogether */
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_DATE);
|
|
+ assert_string_equal(value, "Mar");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_TIME);
|
|
+ assert_string_equal(value, "25");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
|
|
+ assert_string_equal(value, "14:29");
|
|
+ free(value);
|
|
+}
|
|
+
|
|
+static void test_sftp_parse_longname_invalid(void **state)
|
|
+{
|
|
+ const char *lname = NULL;
|
|
+ char *value = NULL;
|
|
+
|
|
+ /* state not used */
|
|
+ (void)state;
|
|
+
|
|
+ /* Invalid inputs should not crash
|
|
+ */
|
|
+ lname = NULL;
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
|
|
+ assert_null(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
|
|
+ assert_null(value);
|
|
+
|
|
+ lname = "";
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
|
|
+ assert_string_equal(value, "");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
|
|
+ assert_null(value);
|
|
+
|
|
+ lname = "-rwxr-xr-x 1";
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
|
|
+ assert_string_equal(value, "-rwxr-xr-x");
|
|
+ free(value);
|
|
+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
|
|
+ assert_null(value);
|
|
+}
|
|
+
|
|
+int torture_run_tests(void)
|
|
+{
|
|
+ int rc;
|
|
+ const struct CMUnitTest tests[] = {
|
|
+ cmocka_unit_test(test_sftp_parse_longname),
|
|
+ cmocka_unit_test(test_sftp_parse_longname_invalid),
|
|
+ };
|
|
+
|
|
+ rc = cmocka_run_group_tests(tests, NULL, NULL);
|
|
+ return rc;
|
|
+}
|