[rpms/proftpd] epel9: Fix heap buffer overflow via SFTP packet reassembly (CVE-2026-63090)

[rpms/proftpd] epel9: Fix heap buffer overflow via SFTP packet reassembly (CVE-2026-63090)

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel9
            Commit : 792754350069b0d185d8a364ab0d8183f1c0aeb6
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-22T15:17:25+01:00
            Stats  : +88/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/792754350069b0d185d8a364ab0d8183f1c0aeb6?branch=epel9

            Log:
            Fix heap buffer overflow via SFTP packet reassembly (CVE-2026-63090)

https://github.com/proftpd/proftpd/issues/2190

---
diff --git a/mod_sftp-1.3.8d-issue2190.patch b/mod_sftp-1.3.8d-issue2190.patch
new file mode 100644
index 0000000..c2b9145
--- /dev/null
+++ b/mod_sftp-1.3.8d-issue2190.patch
@@ -0,0 +1,81 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..a7631eaa4 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -264,11 +264,11 @@ struct fxp_buffer {
+ #define	FXP_PACKET_HAVE_PAYLOAD_SIZE	0x0008
+ #define	FXP_PACKET_HAVE_PAYLOAD		0x0010
+ 
+-/* After 32K of allocation from the scratch SFTP payload pool, destroy the
++/* After 64K of allocation from the scratch SFTP payload pool, destroy the
+  * pool and create a new one.  This will prevent unbounded allocation
+  * from the pool.
+  */
+-#define FXP_PACKET_DATA_ALLOC_MAX_SZ		(1024 * 32)
++#define FXP_PACKET_DATA_ALLOC_MAX_SZ		(1024 * 64)
+ static size_t fxp_packet_data_allocsz = 0;
+ 
+ #define FXP_PACKET_DATA_DEFAULT_SZ		(1024 * 16)
+@@ -3288,37 +3288,45 @@ static void fxp_packet_add_cache(unsigned char *data, uint32_t datalen) {
+ 
+     } else {
+       /* We need a larger buffer.  Round up to the nearest 1K size. */
++      pool *tmp_pool;
++      char *cached_data;
++      uint32_t cached_datalen;
+       size_t sz;
+ 
+-      sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++      if (curr_buflen + datalen > FXP_MAX_PACKET_LEN) {
++        (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++          "received excessive SFTP data (len %lu > max %lu bytes), rejecting",
++          (unsigned long) curr_buflen + datalen,
++          (unsigned long) FXP_MAX_PACKET_LEN);
++        SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++      }
+ 
+-      if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+-        pool *tmp_pool;
+-        char *tmp_data;
+-        uint32_t tmp_datalen;
++      /* Get the existing cached data before allocating a larger buffer. */
++      tmp_pool = make_sub_pool(fxp_pool);
++
++      cached_datalen = curr_buflen;
++      cached_data = palloc(tmp_pool, cached_datalen);
++      memcpy(cached_data, curr_buf, cached_datalen);
+ 
++      if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+         (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+           "renewing SFTP packet data pool");
+ 
+-        tmp_pool = make_sub_pool(fxp_pool);
+-        tmp_datalen = curr_buflen;
+-        tmp_data = palloc(tmp_pool, tmp_datalen);                
+-        memcpy(tmp_data, curr_buf, tmp_datalen);
+-        
+         destroy_pool(curr_buf_pool);
+ 
+         curr_buf_pool = make_sub_pool(fxp_pool);
+         pr_pool_tag(curr_buf_pool, "SFTP packet buffer pool");
++      }
+ 
+-        curr_bufsz = sz;
+-        curr_buf = palloc(curr_buf_pool, curr_bufsz);
+-        fxp_packet_data_allocsz += sz;
++      sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++      curr_bufsz = sz;
++      curr_buf = palloc(curr_buf_pool, curr_bufsz);
++      fxp_packet_data_allocsz += sz;
+ 
+-        memcpy(curr_buf, tmp_data, tmp_datalen);
+-        curr_buflen = tmp_datalen;
++      memcpy(curr_buf, cached_data, cached_datalen);
++      curr_buflen = cached_datalen;
+ 
+-        destroy_pool(tmp_pool);
+-      }
++      destroy_pool(tmp_pool);
+     }
+ 
+     /* Append the SSH2 data to the current unconsumed buffer.

diff --git a/proftpd.spec b/proftpd.spec
index 6b569cb..94f437a 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -75,6 +75,7 @@ Patch24:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
 Patch25:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
 Patch26:		https://github.com/user-attachments/files/30205410/mod_sftp-1.3.8d-issue2115.patch
 Patch27:		https://github.com/proftpd/proftpd/commit/baf4b792.patch
+Patch28:		https://github.com/user-attachments/files/30205541/mod_sftp-1.3.8d-issue2190.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -320,6 +321,10 @@ sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.co
 # as it could possibly overflow our size type (CVE-2026-63091)
 %patch -P 27 -p1
 
+# Authenticated SFTP sessions can overflow the SFTP packet buffer
+# https://github.com/proftpd/proftpd/issues/2190 (CVE-2026-63090)
+%patch -P 28 -p1
+
 # Tweak logrotate script for systemd compatibility (#802178)
 %if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 23)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -573,6 +578,8 @@ fi
   (CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
 - Exercise caution when reading the client-provided file size for SCP uploads,
   as it could possibly overflow our size type (CVE-2026-63091)
+- Authenticated SFTP sessions could overflow the SFTP packet buffer
+  (CVE-2026-63090, https://github.com/proftpd/proftpd/issues/2190)
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-3
 - Additional escaping for avoidance of SQL injection issues with %%{note:...}