git: 533a942a213c - stable/13 - sftp: avoid leaking path arg in calls to make_absolute_pwd_glob

The branch stable/13 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=533a942a213c9e852265f94d27f1e9768294eaa6

commit 533a942a213c9e852265f94d27f1e9768294eaa6
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-11-03 17:17:40 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-04-21 13:45:30 +0000

    sftp: avoid leaking path arg in calls to make_absolute_pwd_glob
    
    As Coverity reports:
        Overwriting tmp in tmp = make_absolute_pwd_glob(tmp, remote_path)
        leaks the storage that tmp points to.
    
    Consume the first arg in make_absolute_pwd_glob, and add xstrdup() to
    the one case which did not assign to the same variable that was passed
    in. With this change make_absolute() and make_absolute_pwd_glob() have
    the same semantics with respect to freeing the input string.
    
    This change was reported to OpenSSH in
    https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-November/040497.html
    [and was later adopted upstream].
    
    Reported by:    Coverity Scan
    CID:            1500409
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37253
    
    (cherry picked from commit 69c72a57af843267b220f8367c4cc7162a12d696)
---
 crypto/openssh/sftp.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/crypto/openssh/sftp.c b/crypto/openssh/sftp.c
index 29081db3d434..ce7ab7f8f2fe 100644
--- a/crypto/openssh/sftp.c
+++ b/crypto/openssh/sftp.c
@@ -617,14 +617,14 @@ escape_glob(const char *s)
 }
 
 static char *
-make_absolute_pwd_glob(const char *p, const char *pwd)
+make_absolute_pwd_glob(char *p, const char *pwd)
 {
 	char *ret, *escpwd;
 
 	escpwd = escape_glob(pwd);
 	if (p == NULL)
 		return escpwd;
-	ret = make_absolute(xstrdup(p), escpwd);
+	ret = make_absolute(p, escpwd);
 	free(escpwd);
 	return ret;
 }
@@ -637,7 +637,7 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst,
 	glob_t g;
 	int i, r, err = 0;
 
-	abs_src = make_absolute_pwd_glob(src, pwd);
+	abs_src = make_absolute_pwd_glob(xstrdup(src), pwd);
 	memset(&g, 0, sizeof(g));
 
 	debug3("Looking up %s", abs_src);
@@ -1997,9 +1997,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
 
 	memset(&g, 0, sizeof(g));
 	if (remote != LOCAL) {
-		tmp2 = make_absolute_pwd_glob(tmp, remote_path);
-		free(tmp);
-		tmp = tmp2;
+		tmp = make_absolute_pwd_glob(tmp, remote_path);
 		remote_glob(conn, tmp, GLOB_DOOFFS|GLOB_MARK, NULL, &g);
 	} else
 		glob(tmp, GLOB_DOOFFS|GLOB_MARK, NULL, &g);