thought. As well as the ".." attack in recursive copies, the name
sent by the client was also trusted in a single-file implicit-
destination copy such as "pscp host:foo .". (The result was ./foo,
where foo is what the server claimed the file was rather than what
the user asked for. I think it's not unreasonable that if the user
requests file `foo' from the host, he should get the result in a
file called `foo' no matter what the host thinks.)
git-svn-id: svn://svn.tartarus.org/sgt/putty@743
cda61777-01e9-0310-a592-
d414129be87e
static void source(char *src);
static void rsource(char *src);
static void source(char *src);
static void rsource(char *src);
-static void sink(char *targ);
+static void sink(char *targ, char *src);
/* GUI Adaptation - Sept 2000 */
static void tell_char(FILE *stream, char c);
static void tell_str(FILE *stream, char *str);
/* GUI Adaptation - Sept 2000 */
static void tell_char(FILE *stream, char c);
static void tell_str(FILE *stream, char *str);
/*
* Execute the sink part of the SCP protocol.
*/
/*
* Execute the sink part of the SCP protocol.
*/
-static void sink(char *targ)
+static void sink(char *targ, char *src)
{
char buf[2048];
char namebuf[2048];
{
char buf[2048];
char namebuf[2048];
if (sscanf(buf+1, "%u %lu %[^\n]", &mode, &size, namebuf) != 3)
bump("Protocol error: Illegal file descriptor format");
if (sscanf(buf+1, "%u %lu %[^\n]", &mode, &size, namebuf) != 3)
bump("Protocol error: Illegal file descriptor format");
+ /* Security fix: ensure the file ends up where we asked for it. */
+ if (src) {
+ char *p = src + strlen(src);
+ while (p > src && p[-1] != '/' && p[-1] != '\\')
+ p--;
+ strcpy(namebuf, p);
+ }
if (targisdir) {
char t[2048];
char *p;
if (targisdir) {
char t[2048];
char *p;
/* can we set the timestamp for directories ? */
continue;
}
/* can we set the timestamp for directories ? */
continue;
}
do_cmd(host, user, cmd);
sfree(cmd);
do_cmd(host, user, cmd);
sfree(cmd);