CVE-2026-35414

كتلة ثغرة CVE-2026-35414

auth2-pubkeyfile.c (قابل للاستغلال)

static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{
	char *result;
	u_int i;

	/* XXX percent_expand() sequences for authorized_principals? */

	for (i = 0; i < cert->nprincipals; i++) {
		if ((result = match_list(cert->principals[i],
		    principal_list, NULL)) != NULL) {
			debug3("matched principal from key options \"%.100s\"",
			    result);
			free(result);
			return 1;
		}
	}
	return 0;
}

auth2-pubkeyfile.c (مُصحَّح)

static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{
	char *list, *olist, *entry;
	u_int i;

	olist = list = xstrdup(principal_list);
	for (;;) {
		if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
			break;
		for (i = 0; i < cert->nprincipals; i++) {
			if (strcmp(entry, cert->principals[i]) == 0) {
				debug3("matched principal from key i"
				    "options \"%.100s\"", entry);
				free(olist);
				return 1;
			}
		}
	}
	free(olist);
	return 0;
}