[rpms/proftpd] epel9: Fix signed integer overflow via scp file size record parser (CVE-2026-63091)

[Paul Howarth <paul@city-fan.org>]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel9
            Commit : 989871ba18bdc54f59c18cb47e3626c9775f468e
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-22T15:04:19+01:00
            Stats  : +56/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/989871ba18bdc54f59c18cb47e3626c9775f468e?branch=epel9

            Log:
            Fix signed integer overflow via scp file size record parser (CVE-2026-63091)

Exercise caution when reading the client-provided file size for SCP uploads,
as it could possibly overflow our size type.

---
diff --git a/baf4b792.patch b/baf4b792.patch
new file mode 100644
index 0000000..5865d81
--- /dev/null
+++ b/baf4b792.patch
@@ -0,0 +1,49 @@
+From baf4b7929758c72cdb6cf16325fa25f435d23db6 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <tj@castaglia.org>
+Date: Wed, 1 Jul 2026 09:14:38 -0700
+Subject: [PATCH] Exercise caution when reading the client-provided file size
+ for SCP uploads, as it could possibly overflow our size type.
+
+Thanks to Fabian Wahle of Hap Security for reporting this issue.
+---
+ contrib/mod_sftp/scp.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/contrib/mod_sftp/scp.c b/contrib/mod_sftp/scp.c
+index 8c105587f..b1f3e89ae 100644
+--- a/contrib/mod_sftp/scp.c
++++ b/contrib/mod_sftp/scp.c
+@@ -603,16 +603,27 @@ static int recv_perms(pool *p, uint32_t channel_id, char *mode_str,
+ 
+ static int recv_filesz(pool *p, uint32_t channel_id, char *size_str,
+     off_t *filesz) {
+-  register unsigned int i;
++  char *endp = NULL;
++  unsigned long long sz;
++  *filesz = 0;
+ 
+-  /* The file size field could be of arbitrary length. */
+-  for (i = 0, *filesz = 0; PR_ISDIGIT(size_str[i]); i++) {
+-    pr_signals_handle();
++#if defined(HAVE_STROULL)
++  sz = strtoull(size_str, &endp, 10);
++#else
++  sz = strtoul(size_str, &endp, 10);
++#endif /* HAVE_STROULL */
+ 
+-    *filesz = (*filesz * 10) + (size_str[i] - '0');
++  *filesz = (off_t) sz;
++
++  /* Watch for cases where the sent file size might overflow our size type. */
++  if (*filesz < 0) {
++    pr_trace_msg(trace_channel, 2, "file size out of range");
++    write_confirm(p, channel_id, 1, "file size out of range");
++    return -1;
+   }
+ 
+-  if (size_str[i] != ' ') {
++  if (endp == NULL ||
++      *endp != ' ') {
+     pr_trace_msg(trace_channel, 2, "file size not followed by space delimiter");
+     write_confirm(p, channel_id, 1, "file size not delimited");
+     return -1;

diff --git a/proftpd.spec b/proftpd.spec
index 1540ce0..6b569cb 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -74,6 +74,7 @@ Patch23:		https://github.com/proftpd/proftpd/commit/07797aba.patch
 Patch24:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
 Patch25:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
 Patch26:		https://github.com/user-attachments/files/30205410/mod_sftp-1.3.8d-issue2115.patch
+Patch27:		https://github.com/proftpd/proftpd/commit/baf4b792.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -315,6 +316,10 @@ sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.co
 # https://github.com/proftpd/proftpd/issues/2115
 %patch -P 26 -p1
 
+# Exercise caution when reading the client-provided file size for SCP uploads,
+# as it could possibly overflow our size type (CVE-2026-63091)
+%patch -P 27 -p1
+
 # Tweak logrotate script for systemd compatibility (#802178)
 %if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 23)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -566,6 +571,8 @@ fi
   (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
 - Fix SFTP request payload length underflow calculation in mod_sftp
   (CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
+- Exercise caution when reading the client-provided file size for SCP uploads,
+  as it could possibly overflow our size type (CVE-2026-63091)
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-3
 - Additional escaping for avoidance of SQL injection issues with %%{note:...}