Fix length check when accepting SFTP connections

WilliamVenner · WilliamVenner · commit 8e49c7c0eda8 · 2026-06-02T20:04:46.000+01:00
diff --git a/sftp/server.go b/sftp/server.go
@@ -143,7 +143,8 @@ func (c *SFTPServer) AcceptInbound(conn net.Conn, config *ssh.ServerConfig) erro
 				// Channels have a type that is dependent on the protocol. For SFTP
 				// this is "subsystem" with a payload that (should) be "sftp". Discard
 				// anything else we receive ("pty", "shell", etc)
-				_ = req.Reply(req.Type == "subsystem" && string(req.Payload[4:]) == "sftp", nil)
+				ok := req.Type == "subsystem" && len(req.Payload) >= 4 && string(req.Payload[4:]) == "sftp"
+				_ = req.Reply(ok, nil)
 			}
 		}(requests)
 

Original file line number	Diff line number	Diff line change
`@@ -143,7 +143,8 @@ func (c SFTPServer) AcceptInbound(conn net.Conn, config ssh.ServerConfig) erro`
`143`	`143`	`// Channels have a type that is dependent on the protocol. For SFTP`
`144`	`144`	`// this is "subsystem" with a payload that (should) be "sftp". Discard`
`145`	`145`	`// anything else we receive ("pty", "shell", etc)`
`146`		`- _ = req.Reply(req.Type == "subsystem" && string(req.Payload[4:]) == "sftp", nil)`
	`146`	`+ ok := req.Type == "subsystem" && len(req.Payload) >= 4 && string(req.Payload[4:]) == "sftp"`
	`147`	`+ _ = req.Reply(ok, nil)`
`147`	`148`	`}`
`148`	`149`	`}(requests)`
`149`	`150`