From e9916c44c1324ab9ab022719e4df08a390a83014 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 5 Jun 2026 08:53:07 +0000 Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp server, previously they were silently dropped; reported by Steve Caffrey ok deraadt@ OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624 CVE: CVE-2026-59997 Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014 Signed-off-by: Thomas Perale --- session.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/session.c b/session.c index dee66598e4e4..fc9c9d6f88ff 100644 --- a/session.c +++ b/session.c @@ -1639,21 +1639,22 @@ do_child(struct ssh *ssh, Session *s, const char *command) exit(1); } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) { extern int optind, optreset; - int i; - char *p, *args; + int sftp_argc; + char **sftp_argv; setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME); - args = xstrdup(command ? command : "sftp-server"); - for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " "))) - if (i < ARGV_MAX - 1) - argv[i++] = p; - argv[i] = NULL; + if (argv_split(command == NULL ? "sftp-server" : command, + &sftp_argc, &sftp_argv, 1) != 0) { + error("internal error: can't split internal-sftp " + "arguments"); + exit(1); + } optind = optreset = 1; - __progname = argv[0]; + __progname = sftp_argv[0]; #ifdef WITH_SELINUX ssh_selinux_change_context("sftpd_t"); #endif - exit(sftp_server_main(i, argv, s->pw)); + exit(sftp_server_main(sftp_argc, sftp_argv, s->pw)); } fflush(NULL);