[rpms/proftpd] epel8: Fix SFTP request payload length underflow calculation (CVE-2026-53994)

[rpms/proftpd] epel8: Fix SFTP request payload length underflow calculation (CVE-2026-53994)

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel8
            Commit : 0caf73d3f35a1ad4305dd894677a5317cf51706b
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-27T16:34:29+01:00
            Stats  : +51/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/0caf73d3f35a1ad4305dd894677a5317cf51706b?branch=epel8

            Log:
            Fix SFTP request payload length underflow calculation (CVE-2026-53994)

https://github.com/proftpd/proftpd/issues/2115

---
diff --git a/mod_sftp-1.3.8d-issue2115.patch b/mod_sftp-1.3.8d-issue2115.patch
new file mode 100644
index 0000000..493d5b7
--- /dev/null
+++ b/mod_sftp-1.3.8d-issue2115.patch
@@ -0,0 +1,44 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..8e867649c 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -3381,6 +3381,23 @@ static struct fxp_packet *fxp_packet_read(uint32_t channel_id,
+       "(%lu bytes remaining in buffer)", (unsigned long) fxp->packet_len,
+       (unsigned long) buflen);
+ 
++    /* We require 5 bytes of SFTP request data at a minimum: 1 byte for the
++     * request type, and 4 bytes for the payload length (Issue #2115).
++     */
++    if (fxp->packet_len < 5) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "illegal SFTP request length (%lu bytes, require at least 5 bytes), "
++        "rejecting", (unsigned long) fxp->packet_len);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
++    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
++        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
+     if (buflen == 0) {
+       fxp_packet_set_packet(fxp);
+       fxp_packet_clear_cache();
+@@ -13674,15 +13691,6 @@ int sftp_fxp_handle_packet(pool *p, void *ssh2, uint32_t channel_id,
+         (unsigned long) channel_id);
+     }
+ 
+-    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
+-      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+-        "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
+-        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
+-      destroy_pool(fxp->pool);
+-      errno = EPERM;
+-      return -1;
+-    }
+-
+     fxp_session = fxp_get_session(channel_id);
+     if (fxp_session == NULL) {
+       (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,

diff --git a/proftpd.spec b/proftpd.spec
index 8b7a7b2..2d533f6 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -107,6 +107,7 @@ Patch118:		proftpd-1.3.6e-issue1840.patch
 Patch119:		https://github.com/proftpd/proftpd/commit/07797aba.patch
 Patch120:		https://github.com/proftpd/proftpd/commit/5e06acc4.patch
 Patch121:		https://github.com/proftpd/proftpd/commit/1a5ce646.patch
+Patch122:		https://github.com/user-attachments/files/30205410/mod_sftp-1.3.8d-issue2115.patch
 
 BuildRequires:		coreutils
 BuildRequires:		gcc
@@ -386,6 +387,10 @@ sed -i -e '/^[[:space:]]*TLSCipherSuite[[:space:]]*PROFILE=SYSTEM$/d' mod_tls.co
 # Address another avenue for SQL injection, via custom SQLUserInfo queries
 %patch -P 121 -p1
 
+# Fix SFTP request payload length underflow calculation in mod_sftp (CVE-2026-53994)
+# https://github.com/proftpd/proftpd/issues/2115
+%patch -P 122 -p1
+
 %if %{use_systemd}
 # Tweak logrotate script for systemd compatibility (#802178)
 sed -i -e '/killall/s/test.*/systemctl reload proftpd.service/' \
@@ -671,6 +676,8 @@ fi
 * Mon Jul 27 2026 Paul Howarth <paul@city-fan.org> - 1.3.6e-11
 - Address another avenue for SQL injection, via custom SQLUserInfo queries
   (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
+- Fix SFTP request payload length underflow calculation in mod_sftp
+  (CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.6e-10
 - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname