[openssh-commits] [openssh] 09/87: upstream: avoid input overrun when quoted argument ends in a

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit f595d60bfd5065e86f1d3bf19de979841a95f89d
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Thu Oct 29 23:04:20 2026 +0000

    upstream: avoid input overrun when quoted argument ends in a
    
    backslash. Anthropic ANT-2026-10NH9RQM
    
    OpenBSD-Commit-ID: bd59a1bf181dbec4ac904760cbc70572564ac8b2
---
 sftp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sftp.c b/sftp.c
index ecbaefd61..dfd0abb20 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.260 2026/10/01 03:11:49 djm Exp $ */
+/* $OpenBSD: sftp.c,v 1.261 2026/10/29 23:04:20 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
  *
@@ -1299,6 +1299,8 @@ makeargv(const char *arg, int *argcp, int sloppy, char *lastquote,
 					argvs[j++] = arg[i];
 				} else {
 					argvs[j++] = arg[i++];
+					if (arg[i] == '\0')
+						goto early_nul;
 					argvs[j++] = arg[i];
 				}
 			} else {

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.