2 files changed, 29 insertions, 11 deletions

diff --git a/ChangeLog b/ChangeLog
index 0eb5fec0e..eae68464d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,9 +1,16 @@
+20030326
+ - (djm) OpenBSD CVS Sync
+   - deraadt@cvs.openbsd.org 2003/03/26 04:02:51
+     [sftp-server.c]
+     one last fix to the tree: race fix broke stuff; pr 3169; 
+     srp@srparish.net, help from djm
+ - Release 3.6p1
+
 20030324
  - (djm) OpenBSD CVS Sync
    - markus@cvs.openbsd.org 2003/03/23 19:02:00
      [monitor.c]
      unbreak rekeying for privsep; ok millert@
- - Release 3.6p1
 
 20030320
  - (djm) OpenBSD CVS Sync
@@ -1247,4 +1254,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2633.2.6 2003/03/23 22:12:50 djm Exp $
+$Id: ChangeLog,v 1.2633.2.7 2003/03/26 04:59:47 djm Exp $
diff --git a/sftp-server.c b/sftp-server.c
index 0c00003f8..9a66b4de7 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.40 2003/03/05 22:33:43 markus Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.41 2003/03/26 04:02:51 deraadt Exp $");
 
 #include "buffer.h"
 #include "bufaux.h"
@@ -836,20 +836,31 @@ process_rename(void)
         u_int32_t id;
         char *oldpath, *newpath;
         int status;
+        struct stat sb;
 
         id = get_int();
         oldpath = get_string(NULL);
         newpath = get_string(NULL);
         TRACE("rename id %u old %s new %s", id, oldpath, newpath);
-        /* fail if 'newpath' exists */
-        if (link(oldpath, newpath) == -1)
+        status = SSH2_FX_FAILURE;
+        if (lstat(oldpath, &sb) == -1)
                 status = errno_to_portable(errno);
-        else if (unlink(oldpath) == -1) {
-                status = errno_to_portable(errno);
-                /* clean spare link */
-                unlink(newpath);
-        } else
-                status = SSH2_FX_OK;
+        else if (S_ISREG(sb.st_mode)) {
+                /* Race-free rename of regular files */
+                if (link(oldpath, newpath) == -1)
+                        status = errno_to_portable(errno);
+                else if (unlink(oldpath) == -1) {
+                        status = errno_to_portable(errno);
+                        /* clean spare link */
+                        unlink(newpath);
+                } else
+                        status = SSH2_FX_OK;
+        } else if (stat(newpath, &sb) == -1) {
+                if (rename(oldpath, newpath) == -1)
+                        status = errno_to_portable(errno);
+                else
+                        status = SSH2_FX_OK;
+        }
         send_status(id, status);
         xfree(oldpath);
         xfree(newpath);