File openssh-cve-2025-61985-nul-url-encode.patch of Package openssh.41559

From 43b3bff47bb029f2299bacb6a36057981b39fdb0 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 4 Sep 2025 00:30:06 +0000
Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings.

Suggested by David Leadbeater, ok deraadt@

OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c
---
 misc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Index: openssh-8.4p1/misc.c
===================================================================
--- openssh-8.4p1.orig/misc.c
+++ openssh-8.4p1/misc.c
@@ -859,9 +859,10 @@ urldecode(const char *src)
 			*dst++ = ' ';
 			break;
 		case '%':
+			/* note: don't allow \0 characters */
 			if (!isxdigit((unsigned char)src[1]) ||
 			    !isxdigit((unsigned char)src[2]) ||
-			    (ch = hexchar(src + 1)) == -1) {
+			    (ch = hexchar(src + 1)) == -1 || ch == 0) {
 				free(ret);
 				return NULL;
 			}