mirror of
git://git.yoctoproject.org/poky
synced 2026-10-02 16:07:07 +00:00
11880c6987
Dropbear shares a lot of code with other SSH implementations, so this is
a port of CVE-2018-20685 to dropbear by the dropbear developers.
Reference:
8f8a3dff70
CVE: CVE-2020-36254
Upstream-Status: Backport
(From OE-Core rev: 10712b736d7cbde897c5aab30e969c04740dce34)
Signed-off-by: Ernst Sjöstrand <ernst.sjostrand@verisure.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
30 lines
896 B
Diff
30 lines
896 B
Diff
From c96c48d62aefc372f2105293ddf8cff2d116dc3a Mon Sep 17 00:00:00 2001
|
|
From: Haelwenn Monnier <contact+github.com@hacktivis.me>
|
|
Date: Mon, 25 May 2020 14:54:29 +0200
|
|
Subject: [PATCH] scp.c: Port OpenSSH CVE-2018-20685 fix (#80)
|
|
|
|
Reference:
|
|
https://github.com/mkj/dropbear/commit/8f8a3dff705fad774a10864a2e3dbcfa9779ceff
|
|
|
|
CVE: CVE-2020-36254
|
|
Upstream-Status: Backport
|
|
|
|
---
|
|
scp.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/scp.c b/scp.c
|
|
index 742ae00..7b8e7d2 100644
|
|
--- a/scp.c
|
|
+++ b/scp.c
|
|
@@ -935,7 +935,8 @@ sink(int argc, char **argv)
|
|
size = size * 10 + (*cp++ - '0');
|
|
if (*cp++ != ' ')
|
|
SCREWUP("size not delimited");
|
|
- if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
|
|
+ if (*cp == '\0' || strchr(cp, '/') != NULL ||
|
|
+ strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
|
|
run_err("error: unexpected filename: %s", cp);
|
|
exit(1);
|
|
}
|