Skip to content

Commit

Permalink
scp: do not NUL-terminate the command for remote exec (#208)
Browse files Browse the repository at this point in the history
It breaks SCP download/upload from/to certain server implementations.

The bug does not manifest with OpenSSH, which silently drops the NUL
byte (eventually with any garbage that follows the NUL byte) before
executing it.

Bug: https://bugzilla.redhat.com/1489736
  • Loading branch information
kdudka authored and willco007 committed Sep 11, 2017
1 parent fe186fe commit 819ef4f
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions src/scp.c
Expand Up @@ -303,8 +303,8 @@ scp_recv(LIBSSH2_SESSION * session, const char *path, libssh2_struct_stat * sb)
&session->scpRecv_command[cmd_len],
session->scpRecv_command_len - cmd_len);

session->scpRecv_command[cmd_len] = '\0';
session->scpRecv_command_len = cmd_len + 1;
/* the command to exec should _not_ be NUL-terminated */
session->scpRecv_command_len = cmd_len;

_libssh2_debug(session, LIBSSH2_TRACE_SCP,
"Opening channel for SCP receive");
Expand Down Expand Up @@ -845,8 +845,8 @@ scp_send(LIBSSH2_SESSION * session, const char *path, int mode,
&session->scpSend_command[cmd_len],
session->scpSend_command_len - cmd_len);

session->scpSend_command[cmd_len] = '\0';
session->scpSend_command_len = cmd_len + 1;
/* the command to exec should _not_ be NUL-terminated */
session->scpSend_command_len = cmd_len;

_libssh2_debug(session, LIBSSH2_TRACE_SCP,
"Opening channel for SCP send");
Expand Down

0 comments on commit 819ef4f

Please sign in to comment.