From 200805ddc9318a99edb9c9a178760dafb85ab60f Mon Sep 17 00:00:00 2001
From: ali <shenzhongli@ieisystem.com>
Date: Wed, 5 Aug 2026 19:38:50 +0800
Subject: [PATCH] [CVE][upstream] FIX CVE-2026-66034

to #41024
add patch to fix CVE-2026-66034
commit a13bb6c773f0d55ad1628cede57e99803cd898d9 upstream.
Project: TC2024080204
---
 fix-CVE-2026-66034.patch | 31 +++++++++++++++++++++++++++++++
 libssh2.spec             |  7 ++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 fix-CVE-2026-66034.patch

diff --git a/fix-CVE-2026-66034.patch b/fix-CVE-2026-66034.patch
new file mode 100644
index 0000000..c0d06df
--- /dev/null
+++ b/fix-CVE-2026-66034.patch
@@ -0,0 +1,31 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Forwarded: not-needed
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@
+                 }
+ 
+                 if(comment_len) {
++                    if(pkey->listFetch_s + comment_len >
++                       pkey->listFetch_data + pkey->listFetch_data_len) {
++                        _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                 "ListFetch data too short");
++                        goto err_exit;
++                    }
++
+                     list[keys].num_attrs = 1;
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,
diff --git a/libssh2.spec b/libssh2.spec
index ddb889d..338608e 100644
--- a/libssh2.spec
+++ b/libssh2.spec
@@ -1,4 +1,4 @@
-%define anolis_release 2
+%define anolis_release 3
 
 Name:		libssh2
 Version:	1.11.1
@@ -31,6 +31,8 @@ Patch0004: libssh2-1.11.1-ssh-rsa-test.patch
 Patch0005: libssh-1.11.1-update-rpath-format.patch
 # https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
 Patch0006: fix-CVE-2026-66033.patch
+# https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
+Patch0007: fix-CVE-2026-66034.patch
 
 BuildRequires:	autoconf
 BuildRequires:	automake
@@ -146,6 +148,9 @@ LC_ALL=en_US.UTF-8 make -C tests check
 %{_libdir}/pkgconfig/libssh2.pc
 
 %changelog
+* Wed Aug 05 2026 ali-inspur <shenzhongli@inspur.com> - 1.11.1-3
+- Fix CVE-2026-66034
+
 * Sat Aug 01 2026 ali-inspur <shenzhongli@inspur.com> - 1.11.1-2
 - Fix CVE-2026-66033
 
-- 
Gitee