CVE-2026-7598 libssh2 整数溢出漏洞

#include <stdio.h> #include <stdint.h> #include <stdlib.h> // Simulating the vulnerable logic in src/userauth.c void vulnerable_userauth_password(uint32_t username_len, uint32_t password_len) { // The vulnerable calculation: adding lengths without overflow check // If username_len is 0xFFFFFFFF, adding 4 wraps around to a small value size_t total_len = (size_t)username_len + (size_t)password_len + 4; printf("Allocating buffer of size: %zu\n", total_len); // malloc allocates a small buffer due to overflow char *buffer = (char *)malloc(total_len); if (buffer) { // This would crash or corrupt heap if copying actual huge data printf("Buffer allocated at %p\n", (void *)buffer); free(buffer); } } int main() { // PoC: Triggering the overflow with max uint32 value printf("PoC for CVE-2026-7598\n"); vulnerable_userauth_password(0xFFFFFFFF, 10); return 0; }