From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 25 Apr 2022 09:41:20 +0000 (+0200)
Subject: libssh2: compare sha256 strings case sensitively
X-Git-Tag: curl-7_83_0~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ff2f3e836702daa82e2356195482fcc95f4257dc;p=thirdparty%2Fcurl.git

libssh2: compare sha256 strings case sensitively

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549435
Closes #8744
---

diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
index 24cad59b3c..81ee671742 100644
--- a/lib/vssh/libssh2.c
+++ b/lib/vssh/libssh2.c
@@ -694,12 +694,12 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
      * against a known fingerprint, if available.
      */
     if((pub_pos != b64_pos) ||
-        Curl_strncasecompare(fingerprint_b64, pubkey_sha256, pub_pos) != 1) {
+       strncmp(fingerprint_b64, pubkey_sha256, pub_pos)) {
       free(fingerprint_b64);
 
       failf(data,
-          "Denied establishing ssh session: mismatch sha256 fingerprint. "
-          "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256);
+            "Denied establishing ssh session: mismatch sha256 fingerprint. "
+            "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256);
       state(data, SSH_SESSION_FREE);
       sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
       return sshc->actualcode;