mirror of https://github.com/wolfSSL/wolfssh.git
3516fb00a0
The built-in SFTP server takes a session only when the subsystem name is sftp, matched whole. DoChannelRequest() keeps the parsed length in channel->commandSz, so neither wolfSSH_SFTP_accept()'s grant gate nor wolfSSH_accept()'s divert serves "sftpx" or "sftp\0evil". - cover a granted name longer than sftp, one of its length, and one running past an embedded NUL - cover the divert with those three names and a control that diverts - exec keeps its command length too Issue: F-11665 |
||
|---|---|---|
| .. | ||
| api.c | ||
| api.h | ||
| auth.c | ||
| auth.h | ||
| include.am | ||
| kex.c | ||
| kex.h | ||
| regress.c | ||
| sftp.c | ||
| sftp.h | ||
| testsuite.c | ||
| testsuite.h | ||
| unit.c | ||
| unit.h | ||