lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00
Code Activity

scp: handle ssh2_snprintf() failure in scp_send()

Browse Source 
It could happen with base paths too large to fit into the 256-byte
response buffer.

Reported-by: QcN3ep
Fixes GHSA-v6rf-jr7x-9hhp
Reported-by: Nora-Qiu
Fixes GHSA-p2v4-ghw2-mvq3

Closes #2573
This commit is contained in:
Viktor Szakats
2026-09-02 22:41:00 +02:00
parent 3a8baf3b81
commit 4884fc6102
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/scp.c
View File

@@ -1071,17 +1071,23 @@ static LIBSSH2_CHANNEL *scp_send(LIBSSH2_SESSION *session,
if(session->scpSend_state == ssh2_NB_state_sent4) {
/* Send mode, size, and basename */
int len;
const char *base = strrchr(path, '/');
if(base)
base++;
else
base = path;
session->scpSend_response_len =
ssh2_snprintf((char *)session->scpSend_response,
SSH2_SCP_RESPONSE_BUFLEN,
"C0%o %" SSH2_INT64_T_FORMAT " %s\n",
(unsigned int)mode, size, base);
len = ssh2_snprintf((char *)session->scpSend_response,
sizeof(session->scpSend_response),
"C0%o %" SSH2_INT64_T_FORMAT " %s\n",
(unsigned int)mode, size, base);
if(len < 0 || (size_t)len >= sizeof(session->scpSend_response)) {
ssh2_err(session, LIBSSH2_ERROR_SCP_PROTOCOL,
"SCP file path too long for response buffer");
goto scp_send_error;
}
session->scpSend_response_len = (size_t)len;
ssh2_deb((session, LIBSSH2_TRACE_SCP, "Sent %s",
session->scpSend_response));