From 5ea9b736de2e03c2e32355e1af5794df0588d623 Mon Sep 17 00:00:00 2001
From: Yosuke Shimizu <yosuke@wolfssl.com>
Date: Mon, 14 Sep 2026 10:20:57 +0900
Subject: [PATCH] scp: drain extended data in the SCP read path

- ScpStreamRead() calls _DumpExtendedData() and reads again when
  wolfSSH_stream_read() returns WS_EXTDATA, reporting the drain's
  own failure when it has one.
- ReceiveScpConfirmation() drops its WS_EXTDATA arm and reports a
  negative read directly.
- ReceiveScpMessage() returns _DumpExtendedData()'s failure in place
  of discarding it.
---
 src/wolfscp.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/wolfscp.c b/src/wolfscp.c
index 0a85343c..4a70816a 100644
--- a/src/wolfscp.c
+++ b/src/wolfscp.c
@@ -195,7 +195,13 @@ static int ScpStreamRead(WOLFSSH* ssh, byte* data, word32 sz)
         }
 
         ret = wolfSSH_stream_read(ssh, data, sz);
-        if (ret < 0 && wolfSSH_get_error(ssh) == WS_REKEYING) {
+        if (ret == WS_EXTDATA) {
+            /* Drain the peer's stderr, then read what it precedes. */
+            ret = _DumpExtendedData(ssh);
+            if (ret != WS_SUCCESS)
+                done = 1;
+        }
+        else if (ret < 0 && wolfSSH_get_error(ssh) == WS_REKEYING) {
             /* Drive the rekey to completion, then retry the read. A worker
              * status that is not rekey or channel data means the rekey stalled
              * or a non-blocking want occurred, so return it rather than
@@ -1805,7 +1811,9 @@ int ReceiveScpMessage(WOLFSSH* ssh)
                     break;
 
                 case WS_EXTDATA:
-                    _DumpExtendedData(ssh);
+                    rc = _DumpExtendedData(ssh);
+                    if (rc != WS_SUCCESS)
+                        return rc;
                     break;
 
                 case WS_WINDOW_FULL:
@@ -1984,10 +1992,7 @@ int ReceiveScpConfirmation(WOLFSSH* ssh)
     msgSz = ScpStreamRead(ssh, msg, DEFAULT_SCP_MSG_SZ);
 
     if (msgSz < 0) {
-        if (msgSz == WS_EXTDATA || wolfSSH_get_error(ssh) == WS_EXTDATA)
-            _DumpExtendedData(ssh);
-        else
-            ret = msgSz;
+        ret = msgSz;
     } else if (msgSz > 1) {
         /* null terminate */
         msg[msgSz] = 0x00;