dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: check return value of sftp_glob() to avoid potential

Browse Source 
disappointment* later

Anthropic ANT-2026-XJ0LZ1TL

* NULL deref

OpenBSD-Commit-ID: a510fcccd788b1e4b7d0a924e3073855a7a8d50d
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:14:15 +11:00
1 parent 2247550884
commit b3325c708a
1 file changed
+16 -4
Download Patch File Download Diff File Expand all files Collapse all files
sftp.c
+16 -4
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sftp.c,v 1.262 2026/10/29 23:07:43 djm Exp $ */
/* $OpenBSD: sftp.c,v 1.263 2026/10/30 04:54:01 djm Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
*
@@ -1665,7 +1665,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
break;
case I_RM:
path1 = make_absolute_pwd_glob(path1, *pwd);
sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
error("Can't glob \"%s\"", path1);
err = -1;
break;
}
for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
if (!quiet)
mprintf("Removing %s\n", g.gl_pathv[i]);
@@ -1777,7 +1781,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
attrib_clear(&a);
a.flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
a.perm = n_arg;
sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
error("Can't glob \"%s\"", path1);
err = -1;
break;
}
for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
if (!quiet)
mprintf("Changing mode on %s\n",
@@ -1791,7 +1799,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
case I_CHOWN:
case I_CHGRP:
path1 = make_absolute_pwd_glob(path1, *pwd);
sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
error("Can't glob \"%s\"", path1);
err = -1;
break;
}
for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
if ((hflag ? sftp_lstat : sftp_stat)(conn,
g.gl_pathv[i], 0, &aa) != 0) {