sftpd: bound the SCP protocol record length

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>

Author: drakkan

internal/sftpd/internal_test.go

@@ -891,6 +891,43 @@ func TestSCPInvalidEndDir(t *testing.T) {
 	assert.EqualError(t, err, "unacceptable end dir command")
 }
 
+func TestSCPMessageSizeLimit(t *testing.T) {
+	stdErrBuf := make([]byte, 65535)
+	connection := &Connection{
+		BaseConnection: common.NewBaseConnection("", common.ProtocolSCP, "", "", dataprovider.User{
+			BaseUser: sdk.BaseUser{
+				HomeDir: os.TempDir(),
+			},
+		}),
+	}
+	scpCommand := scpCommand{
+		sshCommand: sshCommand{
+			command:    "scp",
+			connection: connection,
+			args:       []string{"-t", "/tmp"},
+		},
+	}
+
+	protocolMsg := bytes.Repeat([]byte("A"), maxSCPMessageSize+1)
+	connection.channel = &MockChannel{
+		Buffer:       bytes.NewBuffer(protocolMsg),
+		StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+	}
+	_, err := scpCommand.readProtocolMessage()
+	assert.ErrorContains(t, err, "scp protocol message too long")
+
+	confirmationMsg := append([]byte{warnMsg[0]}, bytes.Repeat([]byte("A"), maxSCPMessageSize+1)...)
+	connection.channel = &MockChannel{
+		Buffer:       bytes.NewBuffer(confirmationMsg),
+		StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+	}
+	err = scpCommand.readConfirmationMessage()
+	assert.ErrorContains(t, err, "scp error message too long")
+
+	assert.Len(t, common.Connections.GetStats(""), 0)
+	assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
+}
+
 func TestSCPParseUploadMessage(t *testing.T) {
 	buf := make([]byte, 65535)
 	stdErrBuf := make([]byte, 65535)

internal/sftpd/scp.go

@@ -35,6 +35,8 @@ import (
 	"github.com/drakkan/sftpgo/v2/internal/vfs"
 )
 
+const maxSCPMessageSize = 8192
+
 var (
 	okMsg   = []byte{0x00}
 	warnMsg = []byte{0x01} // must be followed by an optional message and a newline
@@ -635,6 +637,10 @@ func (c *scpCommand) readConfirmationMessage() error {
 			if n > 0 {
 				msg.Write(readed)
 			}
+			if msg.Len() > maxSCPMessageSize {
+				c.connection.channel.Close()
+				return fmt.Errorf("scp error message too long, max size %d bytes", maxSCPMessageSize)
+			}
 		}
 		c.connection.Log(logger.LevelInfo, "scp error message received: %v is error: %v", msg.String(), isError)
 		err = fmt.Errorf("%v", msg.String())
@@ -660,6 +666,10 @@ func (c *scpCommand) readProtocolMessage() (string, error) {
 				break
 			}
 			command.Write(readed)
+			if command.Len() > maxSCPMessageSize {
+				err = fmt.Errorf("scp protocol message too long, max size %d bytes", maxSCPMessageSize)
+				break
+			}
 		}
 	}
 	if err != nil && !errors.Is(err, io.EOF) {