This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.
Security/robustness
The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.
What's Changed
- fix: ineffective assignments by @alrs in #650
- refactor: replace interface{} with any (Go 1.18+) by @MD-Mushfiqur123 in #652
- fix: bound extended-count pre-allocation in unmarshalFileStat by @drakkan (co-authored by @mjbommar)
New Contributors
- @alrs made their first contribution in #650
- @MD-Mushfiqur123 made their first contribution in #652
Full Changelog: v1.13.10...v1.13.11
Contributors
alrs, mjbommar, and 2 other contributors