From 805388d59d82e80c2f07fefa9e1d28a7aa1ce3fc Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Tue, 15 Sep 2026 08:17:57 +0000
Subject: [PATCH] upstream: sftp: don't crash when glob(3) results lack stat
 information
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid NULL deref crashes when remote glob(3) results lack stat
information. This can happen if the sftp server selectively fails
a stat/lstat operation.

GHPR707 from Nguyễn Anh Bình

OpenBSD-Commit-ID: d76b6fe49bfe1b53908d83cf67ab624b7436279f
---
 sftp-usergroup.c | 2 ++
 sftp.c           | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/sftp-usergroup.c b/sftp-usergroup.c
index d931b2911..cd08610b6 100644
--- a/sftp-usergroup.c
+++ b/sftp-usergroup.c
@@ -154,6 +154,8 @@ collect_ids_from_glob(glob_t *g, int user, u_int **idsp, u_int *nidsp)
 	u_int id, i, n = 0, *ids = NULL;
 
 	for (i = 0; g->gl_pathv[i] != NULL; i++) {
+		if (g->gl_statv[i] == NULL) /* no stat information */
+			continue;
 		if (user) {
 			if (ruser_name(g->gl_statv[i]->st_uid) != NULL)
 				continue; /* Already seen */
diff --git a/sftp.c b/sftp.c
index eba4acfdd..9b403f139 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.258 2026/09/07 20:24:22 job Exp $ */
+/* $OpenBSD: sftp.c,v 1.259 2026/09/15 08:17:57 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -853,6 +853,9 @@ sdirent_comp(const void *aa, const void *bb)
 	int rmul = sort_flag & LS_REVERSE_SORT ? -1 : 1;
 
 #define NCMP(a,b) (a == b ? 0 : (a < b ? 1 : -1))
+	/* order entries without stat information last */
+	if (as == NULL || bs == NULL)
+		return (as == bs) ? 0 : (as == NULL ? rmul : -rmul);
 	if (sort_flag & LS_NAME_SORT)
 		return (rmul * strcmp(a->filename, b->filename));
 	else if (sort_flag & LS_TIME_SORT)