upstream: Sanitize scp filenames via snmprintf. To do this we move

the progressmeter formatting outside of signal handler context and have the
atomicio callback called for EINTR too.  bz#2434 with contributions from djm
and jjelen at redhat.com, ok djm@

OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8

CVE-2019-6109

Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=8976f1c4b2721c26e878151f52bdf346dfe2d54c
Bug-Debian: https://bugs.debian.org/793412
Last-Update: 2019-02-08

Patch-Name: sanitize-scp-filenames-via-snmprintf.patch

1 files changed, 9 insertions, 7 deletions

diff --git a/sftp-client.c b/sftp-client.c
index 4986d6d8d..2bc698f86 100644
--- a/sftp-client.c
+++ b/sftp-client.c
@@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount)
 {
         struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
 
-        bandwidth_limit(bwlimit, amount);
+        refresh_progress_meter();
+        if (bwlimit != NULL)
+                bandwidth_limit(bwlimit, amount);
         return 0;
 }
 
@@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct sshbuf *m)
         iov[1].iov_base = (u_char *)sshbuf_ptr(m);
         iov[1].iov_len = sshbuf_len(m);
 
-        if (atomiciov6(writev, conn->fd_out, iov, 2,
-            conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
+        if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio,
+            conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) !=
             sshbuf_len(m) + sizeof(mlen))
                 fatal("Couldn't send packet: %s", strerror(errno));
 
@@ -138,8 +140,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial)
 
         if ((r = sshbuf_reserve(m, 4, &p)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-        if (atomicio6(read, conn->fd_in, p, 4,
-            conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
+        if (atomicio6(read, conn->fd_in, p, 4, sftpio,
+            conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) {
                 if (errno == EPIPE || errno == ECONNRESET)
                         fatal("Connection closed");
                 else
@@ -157,8 +159,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial)
 
         if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-        if (atomicio6(read, conn->fd_in, p, msg_len,
-            conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
+        if (atomicio6(read, conn->fd_in, p, msg_len, sftpio,
+            conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL)
             != msg_len) {
                 if (errno == EPIPE)
                         fatal("Connection closed");