fix: bound extended-count pre-allocation in unmarshalFileStat

The SSH_FILEXFER_ATTRS decoder allocated the extended-attribute slice
directly from the wire-supplied extended_count.

This is reachable server-side post-authentication via Request.Attributes()
and the SETSTAT/FSETSTAT/OPEN paths, and client-side from a malicious
server via Stat/Lstat/Fstat/Open/ReadDir attribute parsing.

Bound the pre-allocation to the number of entries that can fit in the
remaining bytes (each entry is two length-prefixed strings, i.e. at least
8 bytes) and grow the slice with append.

Co-authored-by: Michael Bommarito <michael.bommarito@gmail.com>

Author: drakkan

packet.go

@@ -225,6 +225,12 @@ func unmarshalFileStat(flags uint32, b []byte) (*FileStat, []byte, error) {
 			return nil, b, err
 		}
 
+		// Each extended attribute occupies at least 8 bytes (two
+		// length-prefixed strings), so a count larger than len(b)/8 cannot
+		// fit and is malformed.
+		if count > uint32(len(b)/8) {
+			return nil, b, errShortPacket
+		}
 		ext := make([]StatExtended, count)
 		for i := uint32(0); i < count; i++ {
 			var typ string

packet_test.go

@@ -31,6 +31,32 @@ func TestMarshalUint32(t *testing.T) {
 	}
 }
 
+func TestUnmarshalFileStatExtendedOverflow(t *testing.T) {
+	// flags = EXTENDED only, extended_count = 0xFFFFFFFF, no entries.
+	b := marshalUint32(nil, 0xFFFFFFFF)
+	if _, _, err := unmarshalFileStat(sshFileXferAttrExtended, b); err != errShortPacket {
+		t.Fatalf("expected errShortPacket, got %v", err)
+	}
+
+	// Well-formed control: a single extended entry must still parse.
+	b = marshalUint32(nil, 1)
+	b = marshalString(b, "type")
+	b = marshalString(b, "data")
+	fs, _, err := unmarshalFileStat(sshFileXferAttrExtended, b)
+	if err != nil {
+		t.Fatalf("unexpected error parsing valid extended attrs: %v", err)
+	}
+	if len(fs.Extended) != 1 {
+		t.Fatalf("got %d extended attrs, want 1", len(fs.Extended))
+	}
+	if fs.Extended[0].ExtType != "type" {
+		t.Errorf("got ext type %q, want %q", fs.Extended[0].ExtType, "type")
+	}
+	if fs.Extended[0].ExtData != "data" {
+		t.Errorf("got ext data %q, want %q", fs.Extended[0].ExtData, "data")
+	}
+}
+
 func TestMarshalUint64(t *testing.T) {
 	var tests = []struct {
 		v    uint64