CVE-2026-59843 tests: Verify zero max packet size in channel open is rejected

Martin Pittrequested to merge
martinpitt/libssh:zero-max-packet-teset into master

Cover both directions with unit tests: a client receiving SSH2_MSG_CHANNEL_OPEN_CONFIRMATION with a maximum packet size of 0 must not transition the channel to the open state, and a server receiving SSH2_MSG_CHANNEL_OPEN with a maximum packet size of 0 must reject the request. Both come with a positive control using a valid packet size.

This adds a unit test for commit 44b186fa . That since got CVE-2026-59843 , and testing it is useful for backporting.

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTING.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code

Merge request reports