From 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Fri, 12 Jun 2026 15:57:44 -0700
Subject: [PATCH] transport.c: Additional boundary checks for packet length
 (#2052)

Add additional bounds checking on packet length to prevent OOB write.

Credit: [TristanInSec](https://github.com/TristanInSec)
---
 src/transport.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

---
Wiggled on top of 1.11.1 by Leah Neukirchen.

--- a/src/transport.c
+++ b/src/transport.c
@@ -639,8 +639,12 @@
                 total_num = 4;
 
                 p->packet_length = _libssh2_ntohu32(block);
-                if(p->packet_length < 1)
+                if(p->packet_length < 1) {
                     return LIBSSH2_ERROR_DECRYPT;
+                }
+                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
+                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+                }
 
                 /* total_num may include size field, however due to existing
                  * logic it needs to be removed after the entire packet is read
