[Git][debian-proftpd-team/proftpd][trixie] 2 commits: Add patches for CVE-2026-53994 / CVE-2026-63090.
Hilmar Preuße (@hilmar)
gitlab at salsa.debian.org
Tue Jul 21 22:43:46 BST 2026
Hilmar Preuße pushed to branch trixie at Debian ProFTPD Team / proftpd
Commits:
1566ec97 by Hilmar Preuße at 2026-07-21T22:43:42+02:00
Add patches for CVE-2026-53994 / CVE-2026-63090.
- - - - -
53dd9175 by Hilmar Preuße at 2026-07-21T22:44:20+02:00
Add patches to d/series.
- - - - -
3 changed files:
- + debian/patches/mod_sftp-1.3.8d-issue2115.diff
- + debian/patches/mod_sftp-1.3.8d-issue2190.diff
- debian/patches/series
Changes:
=====================================
debian/patches/mod_sftp-1.3.8d-issue2115.diff
=====================================
@@ -0,0 +1,44 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..8e867649c 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -3381,6 +3381,23 @@ static struct fxp_packet *fxp_packet_read(uint32_t channel_id,
+ "(%lu bytes remaining in buffer)", (unsigned long) fxp->packet_len,
+ (unsigned long) buflen);
+
++ /* We require 5 bytes of SFTP request data at a minimum: 1 byte for the
++ * request type, and 4 bytes for the payload length (Issue #2115).
++ */
++ if (fxp->packet_len < 5) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "illegal SFTP request length (%lu bytes, require at least 5 bytes), "
++ "rejecting", (unsigned long) fxp->packet_len);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
++
++ if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
++ (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
++
+ if (buflen == 0) {
+ fxp_packet_set_packet(fxp);
+ fxp_packet_clear_cache();
+@@ -13674,15 +13691,6 @@ int sftp_fxp_handle_packet(pool *p, void *ssh2, uint32_t channel_id,
+ (unsigned long) channel_id);
+ }
+
+- if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
+- (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+- "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
+- (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
+- destroy_pool(fxp->pool);
+- errno = EPERM;
+- return -1;
+- }
+-
+ fxp_session = fxp_get_session(channel_id);
+ if (fxp_session == NULL) {
+ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
=====================================
debian/patches/mod_sftp-1.3.8d-issue2190.diff
=====================================
@@ -0,0 +1,81 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..a7631eaa4 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -264,11 +264,11 @@ struct fxp_buffer {
+ #define FXP_PACKET_HAVE_PAYLOAD_SIZE 0x0008
+ #define FXP_PACKET_HAVE_PAYLOAD 0x0010
+
+-/* After 32K of allocation from the scratch SFTP payload pool, destroy the
++/* After 64K of allocation from the scratch SFTP payload pool, destroy the
+ * pool and create a new one. This will prevent unbounded allocation
+ * from the pool.
+ */
+-#define FXP_PACKET_DATA_ALLOC_MAX_SZ (1024 * 32)
++#define FXP_PACKET_DATA_ALLOC_MAX_SZ (1024 * 64)
+ static size_t fxp_packet_data_allocsz = 0;
+
+ #define FXP_PACKET_DATA_DEFAULT_SZ (1024 * 16)
+@@ -3288,37 +3288,45 @@ static void fxp_packet_add_cache(unsigned char *data, uint32_t datalen) {
+
+ } else {
+ /* We need a larger buffer. Round up to the nearest 1K size. */
++ pool *tmp_pool;
++ char *cached_data;
++ uint32_t cached_datalen;
+ size_t sz;
+
+- sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++ if (curr_buflen + datalen > FXP_MAX_PACKET_LEN) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "received excessive SFTP data (len %lu > max %lu bytes), rejecting",
++ (unsigned long) curr_buflen + datalen,
++ (unsigned long) FXP_MAX_PACKET_LEN);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
+
+- if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+- pool *tmp_pool;
+- char *tmp_data;
+- uint32_t tmp_datalen;
++ /* Get the existing cached data before allocating a larger buffer. */
++ tmp_pool = make_sub_pool(fxp_pool);
++
++ cached_datalen = curr_buflen;
++ cached_data = palloc(tmp_pool, cached_datalen);
++ memcpy(cached_data, curr_buf, cached_datalen);
+
++ if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+ "renewing SFTP packet data pool");
+
+- tmp_pool = make_sub_pool(fxp_pool);
+- tmp_datalen = curr_buflen;
+- tmp_data = palloc(tmp_pool, tmp_datalen);
+- memcpy(tmp_data, curr_buf, tmp_datalen);
+-
+ destroy_pool(curr_buf_pool);
+
+ curr_buf_pool = make_sub_pool(fxp_pool);
+ pr_pool_tag(curr_buf_pool, "SFTP packet buffer pool");
++ }
+
+- curr_bufsz = sz;
+- curr_buf = palloc(curr_buf_pool, curr_bufsz);
+- fxp_packet_data_allocsz += sz;
++ sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++ curr_bufsz = sz;
++ curr_buf = palloc(curr_buf_pool, curr_bufsz);
++ fxp_packet_data_allocsz += sz;
+
+- memcpy(curr_buf, tmp_data, tmp_datalen);
+- curr_buflen = tmp_datalen;
++ memcpy(curr_buf, cached_data, cached_datalen);
++ curr_buflen = cached_datalen;
+
+- destroy_pool(tmp_pool);
+- }
++ destroy_pool(tmp_pool);
+ }
+
+ /* Append the SSH2 data to the current unconsumed buffer.
=====================================
debian/patches/series
=====================================
@@ -21,13 +21,16 @@ e7539bd772ca6e12d3e05fb56da274cf78ee1edf.diff
14c006b62c09d1efe302c57b2d183a489bcb22dc.diff
9b2b4a3e32d251798bf8fa841b124ab15ba58f11.diff
2052_pghmcfc.diff
+# issue 2057, CVE-2026-44331
07797aba88dca902da7eaf1dfe262c8896943de7.diff
-# 2115 CVE-2026-53994, do not apply to 1.3.8d
+# issue 2115, CVE-2026-53994
+mod_sftp-1.3.8d-issue2115.diff
#8685930f5e2e448563ef31d8871553308b954785.diff
#a237fa62341bf882c7edc4e5e8cc492cec851d0b.diff
#8ccd66576da8c3e4ca678335268905e00bc71bdb.diff
#226c85b97aa75cef4bdd74e7012b313a801796b5.diff
-# CVE-2026-63091
+# issue 2201, CVE-2026-63091
baf4b7929758c72cdb6cf16325fa25f435d23db6.diff
-# CVE-2026-63090
+# issue 2190, CVE-2026-63090
+mod_sftp-1.3.8d-issue2190.diff
# ce13286900a7e25f1e3403620496868d73292f6b.diff
View it on GitLab: https://salsa.debian.org/debian-proftpd-team/proftpd/-/compare/23070749fe362a327ec2b3049329a2ff1678f05c...53dd91751f679a2ac214445ff87e3c94e8b08ef3
--
View it on GitLab: https://salsa.debian.org/debian-proftpd-team/proftpd/-/compare/23070749fe362a327ec2b3049329a2ff1678f05c...53dd91751f679a2ac214445ff87e3c94e8b08ef3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
More information about the Pkg-proftpd-maintainers
mailing list