File decrypt-len.patch of Package libssh
--- libssh-0.2.orig/libssh/crypt.c 2006-12-29 10:03:59.000000000 -0500
+++ libssh-0.2/libssh/crypt.c 2009-09-21 12:01:19.000000000 -0400
@@ -47,6 +47,12 @@
int packet_decrypt(SSH_SESSION *session, void *data,u32 len){
struct crypto_struct *crypto=session->current_crypto->in_cipher;
char *out=malloc(len);
+
+ if(len % session->current_crypto->in_cipher->blocksize != 0){
+ ssh_set_error(session, SSH_FATAL, "Cryptographic functions must be set on at least one blocksize (received %d)",len);
+ return SSH_ERROR;
+ }
+
ssh_say(3,"Decrypting %d bytes data\n",len);
#ifdef HAVE_LIBGCRYPT
crypto->set_decrypt_key(crypto,session->current_crypto->decryptkey,session->current_crypto->decryptIV);
@@ -69,6 +75,12 @@
u32 seq=ntohl(session->send_seq);
if(!session->current_crypto)
return NULL; /* nothing to do here */
+
+ if(len % session->current_crypto->in_cipher->blocksize != 0){
+ ssh_set_error(session, SSH_FATAL, "Cryptographic functions must be set on at least one blocksize (received %d)",len);
+ return NULL;
+ }
+
crypto= session->current_crypto->out_cipher;
ssh_say(3,"seq num = %d, len = %d\n",session->send_seq,len);
#ifdef HAVE_LIBGCRYPT