From 4f14ca8633a2c8c0a1a19165663421f0ab32f6ab Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Mon, 13 Oct 2025 00:54:29 +0000 Subject: [PATCH] upstream: similar to scp, fix implicit destination path selection when source path ends with ".."; ok deraadt@ OpenBSD-Commit-ID: 9b8d2a662d96b241293a88b3ea21f2419bfc4812 --- sftp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sftp.c b/sftp.c index 57516a73a..c463899c4 100644 --- a/sftp.c +++ b/sftp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sftp.c,v 1.246 2025/10/08 21:48:40 djm Exp $ */ +/* $OpenBSD: sftp.c,v 1.247 2025/10/13 00:54:29 djm Exp $ */ /* * Copyright (c) 2001-2004 Damien Miller * @@ -679,6 +679,10 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst, goto out; } + /* Special handling for dest of '..' */ + if (strcmp(filename, "..") == 0) + filename = "."; /* Download to dest, not dest/.. */ + if (g.gl_matchc == 1 && dst) { if (local_is_dir(dst)) { abs_dst = sftp_path_append(dst, filename); @@ -773,6 +777,9 @@ process_put(struct sftp_conn *conn, const char *src, const char *dst, err = -1; goto out; } + /* Special handling for source of '..' */ + if (strcmp(filename, "..") == 0) + filename = "."; /* Upload to dest, not dest/.. */ free(abs_dst); abs_dst = NULL;