dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: sftp: don't crash when glob(3) results lack stat information

Browse Source 
Avoid NULL deref crashes when remote glob(3) results lack stat
information. This can happen if the sftp server selectively fails
a stat/lstat operation.

GHPR707 from Nguyễn Anh Bình

OpenBSD-Commit-ID: d76b6fe49bfe1b53908d83cf67ab624b7436279f
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-09-15 18:24:11 +10:00
1 parent b99b84822c
commit 805388d59d
2 files changed
+6 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

sftp-usergroup.c
+2
View File
@@ -154,6 +154,8 @@ collect_ids_from_glob(glob_t *g, int user, u_int **idsp, u_int *nidsp)
u_int id, i, n = 0, *ids = NULL;
for (i = 0; g->gl_pathv[i] != NULL; i++) {
if (g->gl_statv[i] == NULL) /* no stat information */
continue;
if (user) {
if (ruser_name(g->gl_statv[i]->st_uid) != NULL)
continue; /* Already seen */
sftp.c
+4 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sftp.c,v 1.258 2026/09/07 20:24:22 job Exp $ */
/* $OpenBSD: sftp.c,v 1.259 2026/09/15 08:17:57 djm Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
*
@@ -853,6 +853,9 @@ sdirent_comp(const void *aa, const void *bb)
int rmul = sort_flag & LS_REVERSE_SORT ? -1 : 1;
#define NCMP(a,b) (a == b ? 0 : (a < b ? 1 : -1))
/* order entries without stat information last */
if (as == NULL || bs == NULL)
return (as == bs) ? 0 : (as == NULL ? rmul : -rmul);
if (sort_flag & LS_NAME_SORT)
return (rmul * strcmp(a->filename, b->filename));
else if (sort_flag & LS_TIME_SORT)