diff options
author | millert@openbsd.org <millert@openbsd.org> | 2017-04-27 11:53:12 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2017-04-28 13:26:36 +1000 |
commit | 91bd2181866659f00714903e78e1c3edd4c45f3d (patch) | |
tree | b6fe734af18bd400a140a94ed781a70af6404406 | |
parent | 17a54a03f5a1d35e33cc24e22cd7a9d0f6865dc4 (diff) |
upstream commit
Avoid potential signed int overflow when parsing the file
size. Use strtoul() instead of parsing manually. OK djm@
Upstream-ID: 1f82640861c7d905bbb05e7d935d46b0419ced02
-rw-r--r-- | scp.c | 13 |
1 files changed, 9 insertions, 4 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: scp.c,v 1.187 2016/09/12 01:22:38 deraadt Exp $ */ | 1 | /* $OpenBSD: scp.c,v 1.188 2017/04/27 11:53:12 millert Exp $ */ |
2 | /* | 2 | /* |
3 | * scp - secure remote copy. This is basically patched BSD rcp which | 3 | * scp - secure remote copy. This is basically patched BSD rcp which |
4 | * uses ssh to do the data transfer (instead of using rcmd). | 4 | * uses ssh to do the data transfer (instead of using rcmd). |
@@ -1043,10 +1043,15 @@ sink(int argc, char **argv) | |||
1043 | if (*cp++ != ' ') | 1043 | if (*cp++ != ' ') |
1044 | SCREWUP("mode not delimited"); | 1044 | SCREWUP("mode not delimited"); |
1045 | 1045 | ||
1046 | for (size = 0; isdigit((unsigned char)*cp);) | 1046 | if (!isdigit((unsigned char)*cp)) |
1047 | size = size * 10 + (*cp++ - '0'); | 1047 | SCREWUP("size not present"); |
1048 | if (*cp++ != ' ') | 1048 | ull = strtoull(cp, &cp, 10); |
1049 | if (!cp || *cp++ != ' ') | ||
1049 | SCREWUP("size not delimited"); | 1050 | SCREWUP("size not delimited"); |
1051 | if ((off_t)ull < 0 || (unsigned long long)(off_t)ull != ull) | ||
1052 | SCREWUP("size out of range"); | ||
1053 | size = (off_t)ull; | ||
1054 | |||
1050 | if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { | 1055 | if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { |
1051 | run_err("error: unexpected filename: %s", cp); | 1056 | run_err("error: unexpected filename: %s", cp); |
1052 | exit(1); | 1057 | exit(1); |