mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 04:43:53 +00:00
sftp: avoid leaking path arg in calls to make_absolute_pwd_glob
As Coverity reports: Overwriting tmp in tmp = make_absolute_pwd_glob(tmp, remote_path) leaks the storage that tmp points to. Consume the first arg in make_absolute_pwd_glob, and add xstrdup() to the one case which did not assign to the same variable that was passed in. With this change make_absolute() and make_absolute_pwd_glob() have the same semantics with respect to freeing the input string. This change was reported to OpenSSH in https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-November/040497.html but was not acted on. It appears that OpenBSD subsequently received a Coverity report for the same issue (their Coverity ID 405196) but fixed only the specific instance reported by Coverity. This change reverts OpenBSD's sftp.c 1.228 / OpenSSH-portable commit 36c6c3eff5e4. Reported by: Coverity Scan CID: 1500409 Reviewed by: markj MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D37253
This commit is contained in:
parent
ef0ac973db
commit
69c72a57af
|
@ -617,14 +617,14 @@ escape_glob(const char *s)
|
|||
}
|
||||
|
||||
static char *
|
||||
make_absolute_pwd_glob(const char *p, const char *pwd)
|
||||
make_absolute_pwd_glob(char *p, const char *pwd)
|
||||
{
|
||||
char *ret, *escpwd;
|
||||
|
||||
escpwd = escape_glob(pwd);
|
||||
if (p == NULL)
|
||||
return escpwd;
|
||||
ret = make_absolute(xstrdup(p), escpwd);
|
||||
ret = make_absolute(p, escpwd);
|
||||
free(escpwd);
|
||||
return ret;
|
||||
}
|
||||
|
@ -637,7 +637,7 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst,
|
|||
glob_t g;
|
||||
int i, r, err = 0;
|
||||
|
||||
abs_src = make_absolute_pwd_glob(src, pwd);
|
||||
abs_src = make_absolute_pwd_glob(xstrdup(src), pwd);
|
||||
memset(&g, 0, sizeof(g));
|
||||
|
||||
debug3("Looking up %s", abs_src);
|
||||
|
@ -1997,9 +1997,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
|
|||
|
||||
memset(&g, 0, sizeof(g));
|
||||
if (remote != LOCAL) {
|
||||
tmp2 = make_absolute_pwd_glob(tmp, remote_path);
|
||||
free(tmp);
|
||||
tmp = tmp2;
|
||||
tmp = make_absolute_pwd_glob(tmp, remote_path);
|
||||
remote_glob(conn, tmp, GLOB_DOOFFS|GLOB_MARK, NULL, &g);
|
||||
} else
|
||||
glob(tmp, GLOB_DOOFFS|GLOB_MARK, NULL, &g);
|
||||
|
|
Loading…
Reference in a new issue