578706adde — curl

Subject

libssh/libssh2: reject quote command lines with too much data

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/vssh/libssh.c +26 -0 lib/vssh/libssh2.c +24 -0

lib/vssh/libssh.c+26 -0

@@ -1557,6 +1557,18 @@ static int myssh_in_SFTP_POSTQUOTE_INIT(struct Curl_easy *data,
	return SSH_NO_ERROR;
	}

+	static int return_quote_error(struct Curl_easy *data,
+	struct ssh_conn *sshc)
+	{
+	failf(data, "Suspicious data after the command line");
+	Curl_safefree(sshc->quote_path1);
+	Curl_safefree(sshc->quote_path2);
+	myssh_to(data, sshc, SSH_SFTP_CLOSE);
+	sshc->nextstate = SSH_NO_STATE;
+	sshc->actualcode = CURLE_QUOTE_ERROR;
+	return SSH_NO_ERROR;
+	}
+
	static int myssh_in_SFTP_QUOTE(struct Curl_easy *data,
	struct ssh_conn *sshc,
	struct SSHPROTO *sshp)
@@ -1665,6 +1677,8 @@ static int myssh_in_SFTP_QUOTE(struct Curl_easy *data,
	sshc->actualcode = result;
	return SSH_NO_ERROR;
	}
+	if(*cp)
+	return return_quote_error(data, sshc);
	sshc->quote_attrs = NULL;
	myssh_to(data, sshc, SSH_SFTP_QUOTE_STAT);
	return SSH_NO_ERROR;
@@ -1686,10 +1700,14 @@ static int myssh_in_SFTP_QUOTE(struct Curl_easy *data,
	sshc->actualcode = result;
	return SSH_NO_ERROR;
	}
+	if(*cp)
+	return return_quote_error(data, sshc);
	myssh_to(data, sshc, SSH_SFTP_QUOTE_SYMLINK);
	return SSH_NO_ERROR;
	}
	else if(!strncmp(cmd, "mkdir ", 6)) {
+	if(*cp)
+	return return_quote_error(data, sshc);
	/* create dir */
	myssh_to(data, sshc, SSH_SFTP_QUOTE_MKDIR);
	return SSH_NO_ERROR;
@@ -1710,20 +1728,28 @@ static int myssh_in_SFTP_QUOTE(struct Curl_easy *data,
	sshc->actualcode = result;
	return SSH_NO_ERROR;
	}
+	if(*cp)
+	return return_quote_error(data, sshc);
	myssh_to(data, sshc, SSH_SFTP_QUOTE_RENAME);
	return SSH_NO_ERROR;
	}
	else if(!strncmp(cmd, "rmdir ", 6)) {
	/* delete dir */
+	if(*cp)
+	return return_quote_error(data, sshc);
	myssh_to(data, sshc, SSH_SFTP_QUOTE_RMDIR);
	return SSH_NO_ERROR;
	}
	else if(!strncmp(cmd, "rm ", 3)) {
+	if(*cp)
+	return return_quote_error(data, sshc);
	myssh_to(data, sshc, SSH_SFTP_QUOTE_UNLINK);
	return SSH_NO_ERROR;
	}
	#ifdef HAS_STATVFS_SUPPORT
	else if(!strncmp(cmd, "statvfs ", 8)) {
+	if(*cp)
+	return return_quote_error(data, sshc);
	myssh_to(data, sshc, SSH_SFTP_QUOTE_STATVFS);
	return SSH_NO_ERROR;
	}

lib/vssh/libssh2.c+24 -0

@@ -843,6 +843,15 @@ static CURLcode ssh_force_knownhost_key_type(struct Curl_easy *data,
	return result;
	}

+	static CURLcode return_quote_error(struct Curl_easy *data,
+	struct ssh_conn *sshc)
+	{
+	failf(data, "Suspicious data after the command line");
+	Curl_safefree(sshc->quote_path1);
+	Curl_safefree(sshc->quote_path2);
+	return CURLE_QUOTE_ERROR;
+	}
+
	static CURLcode sftp_quote(struct Curl_easy *data,
	struct ssh_conn *sshc,
	struct SSHPROTO *sshp)
@@ -930,6 +939,9 @@ static CURLcode sftp_quote(struct Curl_easy *data,
	Curl_safefree(sshc->quote_path1);
	return result;
	}
+	if(*cp)
+	return_quote_error(data, sshc);
+
	memset(&sshp->quote_attrs, 0, sizeof(LIBSSH2_SFTP_ATTRIBUTES));
	myssh_state(data, sshc, SSH_SFTP_QUOTE_STAT);
	return result;
@@ -946,10 +958,14 @@ static CURLcode sftp_quote(struct Curl_easy *data,
	Curl_safefree(sshc->quote_path1);
	return result;
	}
+	if(*cp)
+	return_quote_error(data, sshc);
	myssh_state(data, sshc, SSH_SFTP_QUOTE_SYMLINK);
	return result;
	}
	else if(!strncmp(cmd, "mkdir ", 6)) {
+	if(*cp)
+	return_quote_error(data, sshc);
	/* create dir */
	myssh_state(data, sshc, SSH_SFTP_QUOTE_MKDIR);
	return result;
@@ -965,19 +981,27 @@ static CURLcode sftp_quote(struct Curl_easy *data,
	Curl_safefree(sshc->quote_path1);
	return result;
	}
+	if(*cp)
+	return_quote_error(data, sshc);
	myssh_state(data, sshc, SSH_SFTP_QUOTE_RENAME);
	return result;
	}
	else if(!strncmp(cmd, "rmdir ", 6)) {
+	if(*cp)
+	return_quote_error(data, sshc);
	/* delete dir */
	myssh_state(data, sshc, SSH_SFTP_QUOTE_RMDIR);
	return result;
	}
	else if(!strncmp(cmd, "rm ", 3)) {
+	if(*cp)
+	return_quote_error(data, sshc);
	myssh_state(data, sshc, SSH_SFTP_QUOTE_UNLINK);
	return result;
	}
	else if(!strncmp(cmd, "statvfs ", 8)) {
+	if(*cp)
+	return_quote_error(data, sshc);
	myssh_state(data, sshc, SSH_SFTP_QUOTE_STATVFS);
	return result;
	}