Publickey-Subsystem

libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution

libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…