[openssh-commits] [openssh] 02/02: upstream: sftp: don't crash when glob(3) results lack stat information

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 805388d59d82e80c2f07fefa9e1d28a7aa1ce3fc
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Sep 15 08:17:57 2026 +0000

    upstream: sftp: don't crash when glob(3) results lack stat information
    
    Avoid NULL deref crashes when remote glob(3) results lack stat
    information. This can happen if the sftp server selectively fails
    a stat/lstat operation.
    
    GHPR707 from Nguyễn Anh Bình
    
    OpenBSD-Commit-ID: d76b6fe49bfe1b53908d83cf67ab624b7436279f
---
 sftp-usergroup.c | 2 ++
 sftp.c           | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/sftp-usergroup.c b/sftp-usergroup.c
index d931b2911..cd08610b6 100644
--- a/sftp-usergroup.c
+++ b/sftp-usergroup.c
@@ -154,6 +154,8 @@ collect_ids_from_glob(glob_t *g, int user, u_int **idsp, u_int *nidsp)
 	u_int id, i, n = 0, *ids = NULL;
 
 	for (i = 0; g->gl_pathv[i] != NULL; i++) {
+		if (g->gl_statv[i] == NULL) /* no stat information */
+			continue;
 		if (user) {
 			if (ruser_name(g->gl_statv[i]->st_uid) != NULL)
 				continue; /* Already seen */
diff --git a/sftp.c b/sftp.c
index eba4acfdd..9b403f139 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.258 2026/09/07 20:24:22 job Exp $ */
+/* $OpenBSD: sftp.c,v 1.259 2026/09/15 08:17:57 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
  *
@@ -853,6 +853,9 @@ sdirent_comp(const void *aa, const void *bb)
 	int rmul = sort_flag & LS_REVERSE_SORT ? -1 : 1;
 
 #define NCMP(a,b) (a == b ? 0 : (a < b ? 1 : -1))
+	/* order entries without stat information last */
+	if (as == NULL || bs == NULL)
+		return (as == bs) ? 0 : (as == NULL ? rmul : -rmul);
 	if (sort_flag & LS_NAME_SORT)
 		return (rmul * strcmp(a->filename, b->filename));
 	else if (sort_flag & LS_TIME_SORT)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.