summaryrefslogtreecommitdiff
path: root/scp.c
diff options
context:
space:
mode:
authormillert@openbsd.org <millert@openbsd.org>2017-04-27 11:53:12 +0000
committerDamien Miller <djm@mindrot.org>2017-04-28 13:26:36 +1000
commit91bd2181866659f00714903e78e1c3edd4c45f3d (patch)
treeb6fe734af18bd400a140a94ed781a70af6404406 /scp.c
parent17a54a03f5a1d35e33cc24e22cd7a9d0f6865dc4 (diff)
upstream commit
Avoid potential signed int overflow when parsing the file size. Use strtoul() instead of parsing manually. OK djm@ Upstream-ID: 1f82640861c7d905bbb05e7d935d46b0419ced02
Diffstat (limited to 'scp.c')
-rw-r--r--scp.c13
1 files changed, 9 insertions, 4 deletions
diff --git a/scp.c b/scp.c
index b4db85198..45541af00 100644
--- a/scp.c
+++ b/scp.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: scp.c,v 1.187 2016/09/12 01:22:38 deraadt Exp $ */ 1/* $OpenBSD: scp.c,v 1.188 2017/04/27 11:53:12 millert Exp $ */
2/* 2/*
3 * scp - secure remote copy. This is basically patched BSD rcp which 3 * scp - secure remote copy. This is basically patched BSD rcp which
4 * uses ssh to do the data transfer (instead of using rcmd). 4 * uses ssh to do the data transfer (instead of using rcmd).
@@ -1043,10 +1043,15 @@ sink(int argc, char **argv)
1043 if (*cp++ != ' ') 1043 if (*cp++ != ' ')
1044 SCREWUP("mode not delimited"); 1044 SCREWUP("mode not delimited");
1045 1045
1046 for (size = 0; isdigit((unsigned char)*cp);) 1046 if (!isdigit((unsigned char)*cp))
1047 size = size * 10 + (*cp++ - '0'); 1047 SCREWUP("size not present");
1048 if (*cp++ != ' ') 1048 ull = strtoull(cp, &cp, 10);
1049 if (!cp || *cp++ != ' ')
1049 SCREWUP("size not delimited"); 1050 SCREWUP("size not delimited");
1051 if ((off_t)ull < 0 || (unsigned long long)(off_t)ull != ull)
1052 SCREWUP("size out of range");
1053 size = (off_t)ull;
1054
1050 if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { 1055 if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
1051 run_err("error: unexpected filename: %s", cp); 1056 run_err("error: unexpected filename: %s", cp);
1052 exit(1); 1057 exit(1);