scp.c: fix that scp_recv may transmit not initialised memory

libssh2 · Mar 23, 2015 · 1e7988c · 1e7988c
1 parent b99204f
commit 1e7988c
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/scp.c b/src/scp.c
@@ -299,10 +299,17 @@ scp_recv(LIBSSH2_SESSION * session, const char *path, struct stat * sb)
 
         cmd_len = strlen((char *)session->scpRecv_command);
 
+        memset(&session->scpRecv_command[cmd_len], 0,
+               session->scpRecv_command_len - cmd_len);
+
         (void) shell_quotearg(path,
                               &session->scpRecv_command[cmd_len],
                               session->scpRecv_command_len - cmd_len);
 
+        session->scpRecv_command[session->scpRecv_command_len - 1] = '\0';
+
+        session->scpRecv_command_len =
+            strlen((char *)session->scpRecv_command);
 
         _libssh2_debug(session, LIBSSH2_TRACE_SCP,
                        "Opening channel for SCP receive");