[openssh-commits] [openssh] 47/87: upstream: check return value of sftp_glob() to avoid potential

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit b3325c708a8e63a61a478fd63bff76448babd93a
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 04:54:01 2026 +0000

    upstream: check return value of sftp_glob() to avoid potential
    
    disappointment* later
    
    Anthropic ANT-2026-XJ0LZ1TL
    
    * NULL deref
    
    OpenBSD-Commit-ID: a510fcccd788b1e4b7d0a924e3073855a7a8d50d
---
 sftp.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/sftp.c b/sftp.c
index 00d8dd21c..fdc5167cb 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.262 2026/10/29 23:07:43 djm Exp $ */
+/* $OpenBSD: sftp.c,v 1.263 2026/10/30 04:54:01 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
  *
@@ -1665,7 +1665,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
 		break;
 	case I_RM:
 		path1 = make_absolute_pwd_glob(path1, *pwd);
-		sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
+		if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
+			error("Can't glob \"%s\"", path1);
+			err = -1;
+			break;
+		}
 		for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
 			if (!quiet)
 				mprintf("Removing %s\n", g.gl_pathv[i]);
@@ -1777,7 +1781,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
 		attrib_clear(&a);
 		a.flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
 		a.perm = n_arg;
-		sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
+		if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
+			error("Can't glob \"%s\"", path1);
+			err = -1;
+			break;
+		}
 		for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
 			if (!quiet)
 				mprintf("Changing mode on %s\n",
@@ -1791,7 +1799,11 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
 	case I_CHOWN:
 	case I_CHGRP:
 		path1 = make_absolute_pwd_glob(path1, *pwd);
-		sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
+		if (sftp_glob(conn, path1, GLOB_NOCHECK, NULL, &g) != 0) {
+			error("Can't glob \"%s\"", path1);
+			err = -1;
+			break;
+		}
 		for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
 			if ((hflag ? sftp_lstat : sftp_stat)(conn,
 			    g.gl_pathv[i], 0, &aa) != 0) {

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.