From e19069c9fac4c111d6496b19c7f7db43b4f07b4f Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Wed, 6 Sep 2023 23:23:53 +0000 Subject: [PATCH] upstream: preserve quoting of Subsystem commands and arguments. This may change behaviour of exotic configurations, but the most common subsystem configuration (sftp-server) is unlikely to be affected. OpenBSD-Commit-ID: 8ffa296aeca981de5b0945242ce75aa6dee479bf --- servconf.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/servconf.c b/servconf.c index a3779a9d8..91449d543 100644 --- a/servconf.c +++ b/servconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.c,v 1.398 2023/09/06 23:21:36 djm Exp $ */ +/* $OpenBSD: servconf.c,v 1.399 2023/09/06 23:23:53 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -1960,21 +1960,19 @@ process_server_config_line_depth(ServerOptions *options, char *line, } options->subsystem_name[options->num_subsystems] = xstrdup(arg); arg = argv_next(&ac, &av); - if (!arg || *arg == '\0') + if (!arg || *arg == '\0') { fatal("%s line %d: Missing subsystem command.", filename, linenum); - options->subsystem_command[options->num_subsystems] = xstrdup(arg); - - /* Collect arguments (separate to executable) */ - p = xstrdup(arg); - len = strlen(p) + 1; - while ((arg = argv_next(&ac, &av)) != NULL) { - len += 1 + strlen(arg); - p = xreallocarray(p, 1, len); - strlcat(p, " ", len); - strlcat(p, arg, len); } - options->subsystem_args[options->num_subsystems] = p; + options->subsystem_command[options->num_subsystems] = + xstrdup(arg); + /* Collect arguments (separate to executable) */ + arg = argv_assemble(1, &arg); /* quote command correctly */ + arg2 = argv_assemble(ac, av); /* rest of command */ + xasprintf(&options->subsystem_args[options->num_subsystems], + "%s %s", arg, arg2); + free(arg2); + argv_consume(&ac); options->num_subsystems++; break;