Commit 20856f44 authored by Jakub Jelen's avatar Jakub Jelen
Browse files

CVE-2026-0968: sftp: Sanitize input handling in sftp_parse_longname() 



Signed-off-by: default avatarJakub Jelen <jjelen@redhat.com>
Reviewed-by: default avatarAndreas Schneider <asn@cryptomilk.org>
parent 28d6d10d

src/sftp_common.c

+13 −3
Original line number Diff line number Diff line
@@ -464,16 +464,21 @@ static char * sftp_parse_longname(const char *longname, 
    const char *p = NULL, *q = NULL;

    size_t len, field = 0;



    if (longname == NULL || longname_field < SFTP_LONGNAME_PERM ||

        longname_field > SFTP_LONGNAME_NAME) {

        return NULL;

    }



    p = longname;

    /*

     * Find the beginning of the field which is specified

     * by sftp_longname_field_e.

     */

    while (field != longname_field) {

    while (*p != '\0' && field != longname_field) {

        if (isspace(*p)) {

            field++;

            p++;

            while (*p && isspace(*p)) {

            while (*p != '\0' && isspace(*p)) {

                p++;

            }

        } else {
@@ -481,8 +486,13 @@ static char * sftp_parse_longname(const char *longname, 
        }

    }



    /* If we reached NULL before we got our field fail */

    if (field != longname_field) {

        return NULL;

    }



    q = p;

    while (! isspace(*q)) {

    while (*q != '\0' && !isspace(*q)) {

        q++;

    }