[rpms/proftpd] epel9: Fix SFTP request payload length underflow calculation (CVE-2026-53994)

[rpms/proftpd] epel9: Fix SFTP request payload length underflow calculation (CVE-2026-53994)

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel9
            Commit : 59cb23f386cb7882251a6ea573f927fbfa8f3b49
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-22T14:53:19+01:00
            Stats  : +51/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/59cb23f386cb7882251a6ea573f927fbfa8f3b49?branch=epel9

            Log:
            Fix SFTP request payload length underflow calculation (CVE-2026-53994)

https://github.com/proftpd/proftpd/issues/2115

---
diff --git a/mod_sftp-1.3.8d-issue2115.patch b/mod_sftp-1.3.8d-issue2115.patch
new file mode 100644
index 0000000..493d5b7
--- /dev/null
+++ b/mod_sftp-1.3.8d-issue2115.patch
@@ -0,0 +1,44 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..8e867649c 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -3381,6 +3381,23 @@ static struct fxp_packet *fxp_packet_read(uint32_t channel_id,
+       "(%lu bytes remaining in buffer)", (unsigned long) fxp->packet_len,
+       (unsigned long) buflen);
+ 
++    /* We require 5 bytes of SFTP request data at a minimum: 1 byte for the
++     * request type, and 4 bytes for the payload length (Issue #2115).
++     */
++    if (fxp->packet_len < 5) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "illegal SFTP request length (%lu bytes, require at least 5 bytes), "
++        "rejecting", (unsigned long) fxp->packet_len);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
++    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
++        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
+     if (buflen == 0) {
+       fxp_packet_set_packet(fxp);
+       fxp_packet_clear_cache();
+@@ -13674,15 +13691,6 @@ int sftp_fxp_handle_packet(pool *p, void *ssh2, uint32_t channel_id,
+         (unsigned long) channel_id);
+     }
+ 
+-    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
+-      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+-        "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
+-        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
+-      destroy_pool(fxp->pool);
+-      errno = EPERM;
+-      return -1;
+-    }
+-
+     fxp_session = fxp_get_session(channel_id);
+     if (fxp_session == NULL) {
+       (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,

diff --git a/proftpd.spec b/proftpd.spec
index c2b4815..1540ce0 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -73,6 +73,7 @@ Patch22:		https://github.com/proftpd/proftpd/commit/7e076e84.patch
 Patch23:		https://github.com/proftpd/proftpd/commit/07797aba.patch
 Patch24:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
 Patch25:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
+Patch26:		https://github.com/user-attachments/files/30205410/mod_sftp-1.3.8d-issue2115.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -310,6 +311,10 @@ sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.co
 # Address another avenue for SQL injection, via custom SQLUserInfo queries
 %patch -P 25 -p1
 
+# Fix SFTP request payload length underflow calculation in mod_sftp (CVE-2026-53994)
+# https://github.com/proftpd/proftpd/issues/2115
+%patch -P 26 -p1
+
 # Tweak logrotate script for systemd compatibility (#802178)
 %if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 23)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -559,6 +564,8 @@ fi
 * Wed Jul 22 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-4
 - Address another avenue for SQL injection, via custom SQLUserInfo queries
   (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
+- Fix SFTP request payload length underflow calculation in mod_sftp
+  (CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-3
 - Additional escaping for avoidance of SQL injection issues with %%{note:...}