From 4beed7245889ba149cc372f845d5969ce5103a5d Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Fri, 28 Feb 2025 09:32:30 -0800
Subject: [PATCH] Return error if user KEX methods are invalid #1553 (#1554)

Notes:
Fixes #1553. Restores error case if user passes in invalid KEX method value to libssh2_session_method_pref.

Credit:
Amy Lin

Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 src/kex.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/kex.c b/src/kex.c
index ebee54f987..bafda0e611 100644
--- a/src/kex.c
+++ b/src/kex.c
@@ -4196,23 +4196,11 @@ libssh2_session_method_pref(LIBSSH2_SESSION * session, int method_type,
     char *tmpprefs = NULL;
     size_t prefs_len = strlen(prefs);
     const LIBSSH2_COMMON_METHOD **mlist;
-    const char *kex_extensions = "ext-info-c,kex-strict-c-v00@openssh.com,";
-    size_t kex_extensions_len = strlen(kex_extensions);
 
     switch(method_type) {
     case LIBSSH2_METHOD_KEX:
         prefvar = &session->kex_prefs;
         mlist = (const LIBSSH2_COMMON_METHOD **)libssh2_kex_methods;
-        tmpprefs = LIBSSH2_ALLOC(session, kex_extensions_len + prefs_len + 1);
-        if(!tmpprefs) {
-            return _libssh2_error(session, LIBSSH2_ERROR_ALLOC,
-                                  "Error allocated space for kex method"
-                                  " preferences");
-        }
-        memcpy(tmpprefs, kex_extensions, kex_extensions_len);
-        memcpy(tmpprefs + kex_extensions_len, prefs, prefs_len + 1);
-        prefs = tmpprefs;
-        prefs_len = strlen(prefs);
         break;
 
     case LIBSSH2_METHOD_HOSTKEY:
@@ -4314,6 +4302,27 @@ libssh2_session_method_pref(LIBSSH2_SESSION * session, int method_type,
                               "supported");
     }
 
+    /* add method kex extension to the start of the user list */
+    if(method_type == LIBSSH2_METHOD_KEX) {
+        const char *kex_extensions =
+                    "ext-info-c,kex-strict-c-v00@openssh.com,";
+        size_t kex_extensions_len = strlen(kex_extensions);
+        size_t tmp_len = kex_extensions_len + strlen(newprefs);
+        tmpprefs = LIBSSH2_ALLOC(session, tmp_len + 1);
+        if(!tmpprefs) {
+            return _libssh2_error(session, LIBSSH2_ERROR_ALLOC,
+                                  "Error allocated space for kex method"
+                                  " preferences");
+        }
+
+        memcpy(tmpprefs, kex_extensions, kex_extensions_len);
+        memcpy(tmpprefs + kex_extensions_len, newprefs, strlen(newprefs));
+        tmpprefs[tmp_len] = '\0';
+
+        LIBSSH2_FREE(session, newprefs);
+        newprefs = tmpprefs;
+    }
+
     if(*prefvar) {
         LIBSSH2_FREE(session, *prefvar);
     }
