Mercurial > vanilla

annotate network/openssh/CVE-2018-20685.patch @ 1134:6ab256703d4a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ruby/rb-multi-xml: initial import, closes #2372
author David Demelier <markand@malikania.fr>
date Mon, 23 Sep 2019 20:39:36 +0200
parents f2c94d482098
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
121
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
1 From 6010c0303a422a9c5fa8860c061bf7105eb7f8b2 Mon Sep 17 00:00:00 2001
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
2 From: "djm@openbsd.org" <djm@openbsd.org>
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
3 Date: Fri, 16 Nov 2018 03:03:10 +0000
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
4 Subject: [PATCH] upstream: disallow empty incoming filename or ones that refer
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
5 to the
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
6
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
7 current directory; based on report/patch from Harry Sintonen
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
8
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
9 OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
10 ---
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
11 scp.c | 5 +++--
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
12 1 file changed, 3 insertions(+), 2 deletions(-)
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
13
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
14 diff --git a/scp.c b/scp.c
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
15 index 60682c687..4f3fdcd3d 100644
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
16 --- a/scp.c
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
17 +++ b/scp.c
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
18 @@ -1,4 +1,4 @@
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
19 -/* $OpenBSD: scp.c,v 1.197 2018/06/01 04:31:48 dtucker Exp $ */
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
20 +/* $OpenBSD: scp.c,v 1.198 2018/11/16 03:03:10 djm Exp $ */
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
21 /*
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
22 * scp - secure remote copy. This is basically patched BSD rcp which
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
23 * uses ssh to do the data transfer (instead of using rcmd).
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
24 @@ -1106,7 +1106,8 @@ sink(int argc, char **argv)
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
25 SCREWUP("size out of range");
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
26 size = (off_t)ull;
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
27
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
28 - if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
29 + if (*cp == '\0' || strchr(cp, '/') != NULL ||
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
30 + strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
31 run_err("error: unexpected filename: %s", cp);
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
32 exit(1);
f2c94d482098 network/openssh: initial import, closes #1156
David Demelier <markand@malikania.fr>
parents:
diff changeset
33 }