git: 52503c4477cc - stable/12 - sftp: avoid leaking path arg in calls to make_absolute_pwd_glob

The branch stable/12 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=52503c4477ccba162baca69fb2801f26ff5a5572

commit 52503c4477ccba162baca69fb2801f26ff5a5572
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-11-03 17:17:40 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-06-05 19:07:56 +0000

    sftp: avoid leaking path arg in calls to make_absolute_pwd_glob
    
    As Coverity reports:
        Overwriting tmp in tmp = make_absolute_pwd_glob(tmp, remote_path)
        leaks the storage that tmp points to.
    
    Consume the first arg in make_absolute_pwd_glob, and add xstrdup() to
    the one case which did not assign to the same variable that was passed
    in. With this change make_absolute() and make_absolute_pwd_glob() have
    the same semantics with respect to freeing the input string.
    
    This change was reported to OpenSSH in
    https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-November/040497.html
    [and was later adopted upstream].
    
    Reported by:    Coverity Scan
    CID:            1500409
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37253
    
    (cherry picked from commit 69c72a57af843267b220f8367c4cc7162a12d696)
    (cherry picked from commit 533a942a213c9e852265f94d27f1e9768294eaa6)
---
 crypto/openssh/sftp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/openssh/sftp.c b/crypto/openssh/sftp.c
index c3c347e087e4..630e7773af75 100644
--- a/crypto/openssh/sftp.c
+++ b/crypto/openssh/sftp.c
@@ -621,14 +621,14 @@ escape_glob(const char *s)
 }
 
 static char *
-make_absolute_pwd_glob(const char *p, const char *pwd)
+make_absolute_pwd_glob(char *p, const char *pwd)
 {
 	char *ret, *escpwd;
 
 	escpwd = escape_glob(pwd);
 	if (p == NULL)
 		return escpwd;
-	ret = make_absolute(xstrdup(p), escpwd);
+	ret = make_absolute(p, escpwd);
 	free(escpwd);
 	return ret;
 }
@@ -641,7 +641,7 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst,
 	glob_t g;
 	int i, r, err = 0;
 
-	abs_src = make_absolute_pwd_glob(src, pwd);
+	abs_src = make_absolute_pwd_glob(xstrdup(src), pwd);
 	memset(&g, 0, sizeof(g));
 
 	debug3("Looking up %s", abs_src);