Fix segfault (should free act.buf not act.name, because the latter

[u/mdw/putty] / scp.c

diff --git a/scp.c b/scp.c
index 8b71390..f92485d 100644 (file)
--- a/scp.c
+++ b/scp.c
@@ -686,12 +686,17 @@ static char *colon(char *str)
 
 /*
  * Return a pointer to the portion of str that comes after the last
- * slash (or backslash, if `local' is TRUE).
+ * slash (or backslash or colon, if `local' is TRUE).
  */
 static char *stripslashes(char *str, int local)
 {
     char *p;
 
+    if (local) {
+        p = strchr(str, ':');
+        if (p) str = p+1;
+    }
+
     p = strrchr(str, '/');
     if (p) str = p+1;
 
@@ -772,14 +777,13 @@ void scp_sftp_listdir(char *dirname)
     struct fxp_names *names;
     struct fxp_name *ournames;
     int nnames, namesize;
-    char *dir;
     int i;
 
     printf("Listing directory %s\n", dirname);
 
     dirh = fxp_opendir(dirname);
     if (dirh == NULL) {
-       printf("Unable to open %s: %s\n", dir, fxp_error());
+       printf("Unable to open %s: %s\n", dirname, fxp_error());
     } else {
        nnames = namesize = 0;
        ournames = NULL;
@@ -790,7 +794,7 @@ void scp_sftp_listdir(char *dirname)
            if (names == NULL) {
                if (fxp_error_type() == SSH_FX_EOF)
                    break;
-               printf("Reading directory %s: %s\n", dir, fxp_error());
+               printf("Reading directory %s: %s\n", dirname, fxp_error());
                break;
            }
            if (names->nnames == 0) {
@@ -1689,9 +1693,7 @@ static void rsource(char *src)
 static void sink(char *targ, char *src)
 {
     char *destfname;
-    char ch;
     int targisdir = 0;
-    int settime;
     int exists;
     DWORD attr;
     HANDLE f;
@@ -1725,9 +1727,10 @@ static void sink(char *targ, char *src)
             * Prevent the remote side from maliciously writing to
             * files outside the target area by sending a filename
             * containing `../'. In fact, it shouldn't be sending
-            * filenames with any slashes in at all; so we'll find
-            * the last slash or backslash in the filename and use
-            * only the part after that. (And warn!)
+            * filenames with any slashes or colons in at all; so
+            * we'll find the last slash, backslash or colon in the
+            * filename and use only the part after that. (And
+            * warn!)
             * 
             * In addition, we also ensure here that if we're
             * copying a single file and the target is a directory
@@ -1755,7 +1758,9 @@ static void sink(char *targ, char *src)
            striptarget = stripslashes(act.name, 1);
            if (striptarget != act.name) {
                tell_user(stderr, "warning: remote host sent a compound"
-                         " pathname - possibly malicious! (ignored)");
+                         " pathname '%s'", act.name);
+               tell_user(stderr, "         renaming local file to '%s'",
+                          striptarget);
            }
 
            /*
@@ -1878,7 +1883,7 @@ static void sink(char *targ, char *src)
        }
        (void) scp_finish_filerecv();
        sfree(destfname);
-       sfree(act.name);
+       sfree(act.buf);
     }
 }
 
@@ -1959,13 +1964,6 @@ static void toremote(int argc, char *argv[])
         */
        srcpath = dupstr(src);
        last = stripslashes(srcpath, 1);
-       if (last == srcpath) {
-           last = strchr(srcpath, ':');
-           if (last)
-               last++;
-           else
-               last = srcpath;
-       }
        *last = '\0';
 
        dir = FindFirstFile(src, &fdat);
@@ -1974,7 +1972,6 @@ static void toremote(int argc, char *argv[])
            continue;
        }
        do {
-           char *last;
            char *filename;
            /*
             * Ensure that . and .. are never matched by wildcards,