diff options
| author | Kyle Abramowitz <kyle.abramowitz@momentumdynamics.com> | 2019-08-22 20:58:26 +0000 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2019-08-24 18:47:56 +0200 |
| commit | 25f962193574e35fe638764c3afb9d25d8a9768b (patch) | |
| tree | 9d549c591f9cb78f2c1c78abeebebf22b457c1c7 /lib/curl_path.c | |
| parent | 65fda739ee35c090b2e6d91229287de734f0fbae (diff) | |
| download | curl-25f962193574e35fe638764c3afb9d25d8a9768b.tar.gz | |
scp: fix directory name length used in memcpy
Fix read off end of array due to bad pointer math in getworkingpath for
SCP home directory case.
Closes #4258
Diffstat (limited to 'lib/curl_path.c')
| -rw-r--r-- | lib/curl_path.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/curl_path.c b/lib/curl_path.c index 85dddcef1..f42963463 100644 --- a/lib/curl_path.c +++ b/lib/curl_path.c @@ -55,7 +55,7 @@ CURLcode Curl_getworkingpath(struct connectdata *conn, } if((working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) /* It is referenced to the home directory, so strip the leading '/~/' */ - memcpy(real_path, working_path + 3, 4 + working_path_len-3); + memcpy(real_path, working_path + 3, working_path_len - 2); else memcpy(real_path, working_path, 1 + working_path_len); } |