libssh2_sftp_read() with maxlen of 8192 causes memory corruption about libssh2 HOT 4 CLOSED

I can confirm that some weird things happen if the buffer maxlen is much larger than 4k (7k works for me also, but 8k is too large). I end up in an infinite loop where libssh2_sftp_read() keeps returning 0 (in blocking mode).

I don't get any access violation however (also Win7 x64).

from libssh2.

I have investigated this issue a little further (using example-sftp) on both of my libssh2 builds (Ubuntu 14.10 and Windows 7) at work.

Corrupted downloads happen (in both builds) if buffer_maxlen * 4 > MAX_SFTP_READ_SIZE. So with the current MAX_SFTP_READ_SIZE=30000, problems occur if buffer_maxlen>7500.

Edit: It is actually the "max_read_ahead" value in sftp.c that causes the issue. It is set to 4*buffer_size but if it exceeds MAX_SFTP_READ_SIZE things break.

As a workaround we could use max_read_ahead = MIN(MAX_SFTP_READ_SIZE, 4*buffer_size) until someone figures out the right solution here...

from libssh2.

@Corillian Could you check if my branch https://github.com/jakob/libssh2/tree/sftp-read-fix (see pull request #75) fixes your issues?

from libssh2.

That fix is now merged into master and we believe this bug is fixed. Please provide details if not.

from libssh2.