romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 04:07:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

libssh: catch a resume point larger than the size

Browse source 
As it would otherwise trigger broken math

Reported-by: Joshua Rogers
Closes #19044
This commit is contained in:
Daniel Stenberg 2025-10-13 09:45:28 +02:00
parent 5e74b2df34
commit 6d0fcdf2ed
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vssh/libssh.c
View file

@ -1239,6 +1239,10 @@ static int myssh_in_UPLOAD_INIT(struct Curl_easy *data,
/* now, decrease the size of the read */
if(data->state.infilesize > 0) {
if(data->state.resume_from > data->state.infilesize) {
failf(data, "Resume point beyond size");
return myssh_to_ERROR(data, sshc, CURLE_BAD_FUNCTION_ARGUMENT);
}
data->state.infilesize -= data->state.resume_from;
data->req.size = data->state.infilesize;
Curl_pgrsSetUploadSize(data, data->state.infilesize);