From ab8058d7cd6ad94531ec25b49f56f033f9e168db Mon Sep 17 00:00:00 2001
From: Ruby Martin <ruby@wolfssl.com>
Date: Thu, 6 Aug 2026 15:14:56 -0600
Subject: [PATCH] check return value of WFTELL()

---
 examples/echoserver/echoserver.c              | 13 ++++++++++-
 .../wolfssh_echoserver/main/echoserver.c      | 14 ++++++++++-
 src/wolfscp.c                                 | 23 ++++++++++++++++---
 tests/auth.c                                  |  8 ++++++-
 4 files changed, 52 insertions(+), 6 deletions(-)

diff --git a/examples/echoserver/echoserver.c b/examples/echoserver/echoserver.c
index e0f789bb..93308ae2 100644
--- a/examples/echoserver/echoserver.c
+++ b/examples/echoserver/echoserver.c
@@ -1730,6 +1730,7 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
     WFILE* file;
     word32 fileSz;
     word32 readSz;
+    long tmpSz;
 
     if (fileName == NULL) return 0;
 
@@ -1740,7 +1741,12 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
         return 0;
     }
 
-    fileSz = (word32)WFTELL(NULL, file);
+    tmpSz = WFTELL(NULL, file);
+    if (tmpSz < 0) {
+        WFCLOSE(NULL, file);
+        return 0;
+    }
+    fileSz = (word32)tmpSz;
     WREWIND(NULL, file);
 
     if (buf == NULL || fileSz > *bufSz) {
@@ -2565,6 +2571,11 @@ static char* LoadTpmSshKey(const char* keyFile, const char* username)
         return NULL;
     }
     length = WFTELL(NULL, file);
+    if (length < 0) {
+        fprintf(stderr, "TPM key file tell failed\n");
+        WFCLOSE(NULL, file);
+        return NULL;
+    }
     WREWIND(NULL, file);
 
     usernameLen = WSTRLEN(username);
diff --git a/ide/Espressif/ESP-IDF/examples/wolfssh_echoserver/main/echoserver.c b/ide/Espressif/ESP-IDF/examples/wolfssh_echoserver/main/echoserver.c
index 268fd277..f0557faf 100644
--- a/ide/Espressif/ESP-IDF/examples/wolfssh_echoserver/main/echoserver.c
+++ b/ide/Espressif/ESP-IDF/examples/wolfssh_echoserver/main/echoserver.c
@@ -1660,6 +1660,7 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
     WFILE* file;
     word32 fileSz;
     word32 readSz;
+    long tmpSz;
 
     if (fileName == NULL) return 0;
 
@@ -1669,7 +1670,13 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
         WFCLOSE(NULL, file);
         return 0;
     }
-    fileSz = (word32)WFTELL(NULL, file);
+
+    tmpSz = WFTELL(NULL, file);
+    if (tmpSz < 0) {
+        WFCLOSE(NULL, file);
+        return 0;
+    }
+    fileSz = (word32)tmpSz;
     WREWIND(NULL, file);
 
     if (buf == NULL || fileSz > *bufSz) {
@@ -2182,6 +2189,11 @@ static char* LoadTpmSshKey(const char* keyFile, const char* username)
         return NULL;
     }
     length = WFTELL(NULL, file);
+    if (length < 0) {
+        fprintf(stderr, "TPM key file tell failed\n");
+        WFCLOSE(NULL, file);
+        return NULL;
+    }
     WREWIND(NULL, file);
 
     usernameLen = WSTRLEN(username);
diff --git a/src/wolfscp.c b/src/wolfscp.c
index 5bfac25a..5ccd1975 100644
--- a/src/wolfscp.c
+++ b/src/wolfscp.c
@@ -2685,6 +2685,8 @@ int wsScpRecvCallback(WOLFSSH* ssh, int state, const char* basePath,
 
 static int _GetFileSize(void* fs, WFILE* fp, word32* fileSz)
 {
+    long tmpSz;
+
     WOLFSSH_UNUSED(fs);
 
     if (fp == NULL || fileSz == NULL)
@@ -2692,7 +2694,11 @@ static int _GetFileSize(void* fs, WFILE* fp, word32* fileSz)
 
     /* get file size */
     if (WFSEEK_SUCCESS(WFSEEK(fs, fp, 0, WSEEK_END))) {
-        *fileSz = (word32)WFTELL(fs, fp);
+        tmpSz = WFTELL(fs, fp);
+        if (tmpSz < 0) {
+            return WS_BAD_FILE_E;
+        }
+        *fileSz = (word32)tmpSz;
         WREWIND(fs, fp);
 
         return WS_SUCCESS;
@@ -3183,8 +3189,14 @@ static int ScpProcessEntry(WOLFSSH* ssh, char* fileName, word64* mTime,
             if (ret == WS_SUCCESS) {
                 ret = _GetFileSize(ssh->fs, sendCtx->fp, totalFileSz);
 
-                if (ret == WS_SUCCESS)
+                if (ret != WS_SUCCESS) {
+                    WLOG(WS_LOG_ERROR, "scp: unable to get file size, abort");
+                    wolfSSH_SetScpErrorMsg(ssh, "unable to get file size");
+                    ret = WS_SCP_ABORT;
+                }
+                else {
                     ret = (word32)WFREAD(ssh->fs, buf, 1, bufSz, sendCtx->fp);
+                }
             }
 
             /* keep fp open if no errors and transfer will continue */
@@ -3357,8 +3369,13 @@ int wsScpSendCallback(WOLFSSH* ssh, int state, const char* peerRequest,
             #endif
             }
 
-            if (ret == WS_SUCCESS)
+            if (ret == WS_SUCCESS) {
                 ret = _GetFileSize(ssh->fs, sendCtx->fp, totalFileSz);
+                if (ret != WS_SUCCESS) {
+                    WLOG(WS_LOG_ERROR, "scp: unable to get file size, abort");
+                    wolfSSH_SetScpErrorMsg(ssh, "unable to get file size");
+                }
+            }
 
             if (ret == WS_SUCCESS)
                 ret = GetFileStats(ssh->fs, sendCtx, peerRequest, mTime, aTime, fileMode);
diff --git a/tests/auth.c b/tests/auth.c
index 953b3574..3b45a631 100644
--- a/tests/auth.c
+++ b/tests/auth.c
@@ -177,6 +177,7 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
     WFILE* file;
     word32 fileSz;
     word32 readSz;
+    long tmpSz;
 
     if (fileName == NULL) return 0;
 
@@ -186,7 +187,12 @@ static int load_file(const char* fileName, byte* buf, word32* bufSz)
         WFCLOSE(NULL, file);
         return 0;
     }
-    fileSz = (word32)WFTELL(NULL, file);
+    tmpSz = WFTELL(NULL, file);
+    if (tmpSz < 0) {
+        WFCLOSE(NULL, file);
+        return 0;
+    }
+    fileSz = (word32)tmpSz;
     WREWIND(NULL, file);
 
     if (buf == NULL || fileSz > *bufSz) {