lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-07-31 00:03:08 +03:00
Code Activity

scp: fix NULL dereference in path arg of send/recv (#1625)

Browse Source 
Notes:
* Error handling if path for scp is NULL

Reported-by:
Liu Xing Yu

Credit:
Ryan Kelley
This commit is contained in:
Ryan Kelley
2025-07-21 13:02:42 -04:00
committed by GitHub
parent f46422223f
commit 992dafbc7f
4 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/libssh2_scp_recv.3
View File

@ -28,6 +28,8 @@ Pointer to a newly allocated LIBSSH2_CHANNEL instance, or NULL on errors.
.SH ERRORS
\fILIBSSH2_ERROR_ALLOC\fP - An internal memory allocation call failed.
\fILIBSSH2_ERROR_INVAL\fP - Invalid argument used in function call.
\fILIBSSH2_ERROR_SCP_PROTOCOL\fP -
\fILIBSSH2_ERROR_EAGAIN\fP - Marked for non-blocking I/O but the call would

2
docs/libssh2_scp_recv2.3
View File

@ -25,6 +25,8 @@ Pointer to a newly allocated LIBSSH2_CHANNEL instance, or NULL on errors.
.SH ERRORS
\fILIBSSH2_ERROR_ALLOC\fP - An internal memory allocation call failed.
\fILIBSSH2_ERROR_INVAL\fP - Invalid argument used in function call.
\fILIBSSH2_ERROR_SCP_PROTOCOL\fP -
\fILIBSSH2_ERROR_EAGAIN\fP - Marked for non-blocking I/O but the call would

2
docs/libssh2_scp_send64.3
View File

@ -37,6 +37,8 @@ Pointer to a newly allocated LIBSSH2_CHANNEL instance, or NULL on errors.
.SH ERRORS
\fILIBSSH2_ERROR_ALLOC\fP - An internal memory allocation call failed.
\fILIBSSH2_ERROR_INVAL\fP - Invalid argument used in function call.
\fILIBSSH2_ERROR_SOCKET_SEND\fP - Unable to send data on socket.
\fILIBSSH2_ERROR_SCP_PROTOCOL\fP -

12
src/scp.c
View File

@ -284,6 +284,12 @@ scp_recv(LIBSSH2_SESSION * session, const char *path, libssh2_struct_stat * sb)
int tmp_err_code;
const char *tmp_err_msg;
if(!path) {
_libssh2_error(session, LIBSSH2_ERROR_INVAL,
"Path argument can not be null");
return NULL;
}
if(session->scpRecv_state == libssh2_NB_state_idle) {
session->scpRecv_mode = 0;
session->scpRecv_size = 0;
@ -860,6 +866,12 @@ scp_send(LIBSSH2_SESSION * session, const char *path, int mode,
int tmp_err_code;
const char *tmp_err_msg;
if(!path) {
_libssh2_error(session, LIBSSH2_ERROR_INVAL,
"Path argument can not be null");
return NULL;
}
if(session->scpSend_state == libssh2_NB_state_idle) {
session->scpSend_command_len =
_libssh2_shell_quotedsize(path) + sizeof("scp -t ") +