- guenther@cvs.openbsd.org 2009/12/20 07:28:36

     [ssh.c sftp.c scp.c]
     When passing user-controlled options with arguments to other programs,
     pass the option and option argument as separate argv entries and
     not smashed into one (e.g., as -l foo and not -lfoo).  Also, always
     pass a "--" argument to stop option parsing, so that a positional
     argument that starts with a '-' isn't treated as an option.  This
     fixes some error cases as well as the handling of hostnames and
     filenames that start with a '-'.
     Based on a diff by halex@
     ok halex@ djm@ deraadt@

1 files changed, 14 insertions, 7 deletions

diff --git a/scp.c b/scp.c
index 323747806..09efb82ac 100644
--- a/scp.c
+++ b/scp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: scp.c,v 1.164 2008/10/10 04:55:16 stevesk Exp $ */
+/* $OpenBSD: scp.c,v 1.165 2009/12/20 07:28:36 guenther Exp $ */
 /*
  * scp - secure remote copy.  This is basically patched BSD rcp which
  * uses ssh to do the data transfer (instead of using rcmd).
@@ -244,8 +244,11 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout)
                 close(pout[1]);
 
                 replacearg(&args, 0, "%s", ssh_program);
-                if (remuser != NULL)
-                        addargs(&args, "-l%s", remuser);
+                if (remuser != NULL) {
+                        addargs(&args, "-l");
+                        addargs(&args, "%s", remuser);
+                }
+                addargs(&args, "--");
                 addargs(&args, "%s", host);
                 addargs(&args, "%s", cmd);
 
@@ -337,10 +340,12 @@ main(int argc, char **argv)
                 case 'c':
                 case 'i':
                 case 'F':
-                        addargs(&args, "-%c%s", ch, optarg);
+                        addargs(&args, "-%c", ch);
+                        addargs(&args, "%s", optarg);
                         break;
                 case 'P':
-                        addargs(&args, "-p%s", optarg);
+                        addargs(&args, "-p");
+                        addargs(&args, "%s", optarg);
                         break;
                 case 'B':
                         addargs(&args, "-oBatchmode yes");
@@ -548,6 +553,7 @@ toremote(char *targ, int argc, char **argv)
                         } else {
                                 host = cleanhostname(argv[i]);
                         }
+                        addargs(&alist, "--");
                         addargs(&alist, "%s", host);
                         addargs(&alist, "%s", cmd);
                         addargs(&alist, "%s", src);
@@ -558,7 +564,7 @@ toremote(char *targ, int argc, char **argv)
                                 errs = 1;
                 } else {        /* local to remote */
                         if (remin == -1) {
-                                xasprintf(&bp, "%s -t %s", cmd, targ);
+                                xasprintf(&bp, "%s -t -- %s", cmd, targ);
                                 host = cleanhostname(thost);
                                 if (do_cmd(host, tuser, bp, &remin,
                                     &remout) < 0)
@@ -591,6 +597,7 @@ tolocal(int argc, char **argv)
                                 addargs(&alist, "-r");
                         if (pflag)
                                 addargs(&alist, "-p");
+                        addargs(&alist, "--");
                         addargs(&alist, "%s", argv[i]);
                         addargs(&alist, "%s", argv[argc-1]);
                         if (do_local_cmd(&alist))
@@ -610,7 +617,7 @@ tolocal(int argc, char **argv)
                                 suser = pwd->pw_name;
                 }
                 host = cleanhostname(host);
-                xasprintf(&bp, "%s -f %s", cmd, src);
+                xasprintf(&bp, "%s -f -- %s", cmd, src);
                 if (do_cmd(host, suser, bp, &remin, &remout) < 0) {
                         (void) xfree(bp);
                         ++errs;