summaryrefslogtreecommitdiff
path: root/usr.bin/ssh
diff options
context:
space:
mode:
authorDarren Tucker <dtucker@cvs.openbsd.org>2006-07-11 10:12:08 +0000
committerDarren Tucker <dtucker@cvs.openbsd.org>2006-07-11 10:12:08 +0000
commit138ff61f828d400728e67dedebd8e03f940d28fb (patch)
tree05a6c59cfed227f4aad95fd279c79cca834ffb1a /usr.bin/ssh
parentf734fe12f09291767af1ac8266205551f812952e (diff)
Only copy the part of environment variable that we actually use. Prevents
ssh bailing when SendEnv is used and an environment variable with a really long value exists. ok djm@
Diffstat (limited to 'usr.bin/ssh')
-rw-r--r--usr.bin/ssh/ssh.c13
1 files changed, 6 insertions, 7 deletions
diff --git a/usr.bin/ssh/ssh.c b/usr.bin/ssh/ssh.c
index 08f97a41a79..348ad62d638 100644
--- a/usr.bin/ssh/ssh.c
+++ b/usr.bin/ssh/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.281 2006/07/09 15:15:11 stevesk Exp $ */
+/* $OpenBSD: ssh.c,v 1.282 2006/07/11 10:12:07 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1241,15 +1241,14 @@ control_client_sigrelay(int signo)
static int
env_permitted(char *env)
{
- int i;
+ int i, ret;
char name[1024], *cp;
- if (strlcpy(name, env, sizeof(name)) >= sizeof(name))
- fatal("env_permitted: name too long");
- if ((cp = strchr(name, '=')) == NULL)
+ if ((cp = strchr(env, '=')) == NULL || cp == env)
return (0);
-
- *cp = '\0';
+ ret = snprintf(name, sizeof(name), "%.*s", (cp - env), env);
+ if (ret <= 0 || (size_t)ret >= sizeof(name))
+ fatal("env_permitted: name '%.100s...' too long", env);
for (i = 0; i < options.num_send_env; i++)
if (match_pattern(name, options.send_env[i]))