Bound SFTP NAME response size on the client

[yosuke-wolfssl]

Bound SFTP NAME response size on the client

Summary

wolfSSH_SFTP_DoName processes SSH_FXP_NAME responses (READDIR, REALPATH, LS) by buffering the whole message and then allocating one WS_SFTPNAME node (~88 bytes) per entry, plus heap copies of each entry's fName/lName.
The message size came straight off the wire with no upper bound, so a malicious or MITM SFTP server could send an over-large NAME packet and amplify it into several times that much simultaneously-live client heap (a verified ~8x peak relative to on-wire bytes), leading to client-side OOM.
This is reachable automatically on connect via the initial REALPATH(".").

This adds a configurable upper bound on the NAME message size. Capping the message size bounds both the 1:1 receive buffer and, transitively, the per-entry node amplification (the parse loop cannot produce more entries than fit in the bounded buffer).

Changes

• WOLFSSH_MAX_SFTP_NAME (default 1 MiB), overridable at build time, added alongside the existing WOLFSSH_MAX_SFTP_* limits in wolfssh/wolfsftp.h. The default is generous because the wolfSSH server sends an entire directory listing in a single, un-chunked NAME packet, so a smaller cap would risk breaking legitimate large-directory listings; 1 MiB bounds peak heap to a few MiB while leaving ample headroom.
• wolfSSH_SFTP_DoName rejects a NAME message whose declared size exceeds WOLFSSH_MAX_SFTP_NAME (sets WS_BUFFER_E, clears state, returns NULL) before allocating the buffer. The reject log line reports both the offending size and the configured limit.
• Unit test test_SftpDoName_sizeBound (tests/unit.c) injects a crafted NAME header into a channel and drives DoName via a new wolfSSH_TestSftpDoName internal test hook. It checks both the over-limit rejection (WS_BUFFER_E) and the at-limit accept case, pinning the strict > boundary against future off-by-one regressions.

Testing

• ./configure --enable-sftp && make — clean.
• scripts/sftp.test (REALPATH/LS over a live client/server) — passes; normal
  listings work under the 1 MiB cap.
• tests/unit.test — SftpDoName_sizeBound: SUCCESS, full suite passing.
• Negative control: disabling the bound makes the unit test FAIL, confirming it
  catches the regression.

[Copilot]

Pull request overview

This PR adds a client-side upper bound for SFTP SSH_FXP_NAME response payloads to prevent malicious servers from triggering excessive heap growth during NAME parsing (notably reachable via the initial REALPATH(".") on connect).

Changes:

• Introduces WOLFSSH_MAX_SFTP_NAME (default 1 MiB, build-time overridable) as a dedicated cap for SFTP NAME response payload size.
• Enforces the cap in wolfSSH_SFTP_DoName() before allocating the receive buffer and building the WS_SFTPNAME list.
• Adds a unit test (test_SftpDoName_sizeBound) and a new internal test hook (wolfSSH_TestSftpDoName) to pin the strict > boundary behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
wolfssh/wolfsftp.h	Adds the configurable WOLFSSH_MAX_SFTP_NAME limit and an internal test-hook declaration.
src/wolfsftp.c	Rejects over-limit NAME payloads in wolfSSH_SFTP_DoName(); adds wolfSSH_TestSftpDoName() helper for tests.
tests/unit.c	Adds a unit test that injects crafted NAME headers to validate over-limit rejection and at-limit acceptance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1036

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅