From owner-svn-src-head@freebsd.org  Tue Jan 15 17:00:15 2019
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id DF3911490327;
 Tue, 15 Jan 2019 17:00:15 +0000 (UTC)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: from pdx.rh.CN85.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 5E7E78EF2C;
 Tue, 15 Jan 2019 17:00:14 +0000 (UTC)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: from pdx.rh.CN85.dnsmgr.net (localhost [127.0.0.1])
 by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3) with ESMTP id x0FH0CIt041084;
 Tue, 15 Jan 2019 09:00:12 -0800 (PST)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: (from freebsd@localhost)
 by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3/Submit) id x0FH0Crl041083;
 Tue, 15 Jan 2019 09:00:12 -0800 (PST) (envelope-from freebsd)
From: "Rodney W. Grimes" <freebsd@pdx.rh.CN85.dnsmgr.net>
Message-Id: <201901151700.x0FH0Crl041083@pdx.rh.CN85.dnsmgr.net>
Subject: Re: svn commit: r343043 - head/crypto/openssh
In-Reply-To: <201901151535.x0FFZE94018787@repo.freebsd.org>
To: Ed Maste <emaste@freebsd.org>
Date: Tue, 15 Jan 2019 09:00:12 -0800 (PST)
CC: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Reply-To: rgrimes@freebsd.org
X-Mailer: ELM [version 2.4ME+ PL121h (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
X-Rspamd-Queue-Id: 5E7E78EF2C
X-Spamd-Bar: ------
Authentication-Results: mx1.freebsd.org
X-Spamd-Result: default: False [-6.97 / 15.00];
 NEURAL_HAM_MEDIUM(-1.00)[-1.000,0];
 NEURAL_HAM_SHORT(-0.97)[-0.971,0]; REPLY(-4.00)[];
 NEURAL_HAM_LONG(-1.00)[-1.000,0]
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Jan 2019 17:00:16 -0000

> Author: emaste
> Date: Tue Jan 15 15:35:14 2019
> New Revision: 343043
> URL: https://svnweb.freebsd.org/changeset/base/343043
> 
> Log:
>   scp: disallow empty or current directory
>   
>   Obtained from:	OpenBSD scp.c 1.198
>   Security:	CVE-2018-20685
>   Sponsored by:	The FreeBSD Foundation

Can this be MFCed to 12, 11 and 10?

> 
> Modified:
>   head/crypto/openssh/scp.c
> 
> Modified: head/crypto/openssh/scp.c
> ==============================================================================
> --- head/crypto/openssh/scp.c	Tue Jan 15 09:48:18 2019	(r343042)
> +++ head/crypto/openssh/scp.c	Tue Jan 15 15:35:14 2019	(r343043)
> @@ -1106,7 +1106,8 @@ sink(int argc, char **argv)
>  			SCREWUP("size out of range");
>  		size = (off_t)ull;
>  
> -		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
> +		if (*cp == '\0' || strchr(cp, '/') != NULL ||
> +		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
>  			run_err("error: unexpected filename: %s", cp);
>  			exit(1);
>  		}
> 
> 

-- 
Rod Grimes                                                 rgrimes@freebsd.org