From 25f962193574e35fe638764c3afb9d25d8a9768b Mon Sep 17 00:00:00 2001 From: Kyle Abramowitz Date: Thu, 22 Aug 2019 20:58:26 +0000 Subject: scp: fix directory name length used in memcpy Fix read off end of array due to bad pointer math in getworkingpath for SCP home directory case. Closes #4258 --- lib/curl_path.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/curl_path.c') diff --git a/lib/curl_path.c b/lib/curl_path.c index 85dddcef1..f42963463 100644 --- a/lib/curl_path.c +++ b/lib/curl_path.c @@ -55,7 +55,7 @@ CURLcode Curl_getworkingpath(struct connectdata *conn, } if((working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) /* It is referenced to the home directory, so strip the leading '/~/' */ - memcpy(real_path, working_path + 3, 4 + working_path_len-3); + memcpy(real_path, working_path + 3, working_path_len - 2); else memcpy(real_path, working_path, 1 + working_path_len); } -- cgit v1.2.1