fix some corner-case bugs in scp sftp-mode handling of ~-prefixed

paths; spotted by jsg; feedback jsg & deraadt, ok jsg & markus

1 files changed, 10 insertions, 5 deletions

diff --git a/usr.bin/ssh/scp.c b/usr.bin/ssh/scp.c
index 9fe7c4848d3..c0e05735885 100644
--- a/usr.bin/ssh/scp.c
+++ b/usr.bin/ssh/scp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: scp.c,v 1.241 2021/10/24 21:24:17 deraadt Exp $ */
+/* $OpenBSD: scp.c,v 1.242 2022/01/08 07:36:11 djm Exp $ */
 /*
  * scp - secure remote copy.  This is basically patched BSD rcp which
  * uses ssh to do the data transfer (instead of using rcmd).
@@ -1217,13 +1217,18 @@ tolocal(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
 static char *
 prepare_remote_path(struct sftp_conn *conn, const char *path)
 {
+	size_t nslash;
+
 	/* Handle ~ prefixed paths */
-	if (*path != '~')
-		return xstrdup(path);
 	if (*path == '\0' || strcmp(path, "~") == 0)
 		return xstrdup(".");
-	if (strncmp(path, "~/", 2) == 0)
-		return xstrdup(path + 2);
+	if (*path != '~')
+		return xstrdup(path);
+	if (strncmp(path, "~/", 2) == 0) {
+		if ((nslash = strspn(path + 2, "/")) == strlen(path + 2))
+			return xstrdup(".");
+		return xstrdup(path + 2 + nslash);
+	}
 	if (can_expand_path(conn))
 		return do_expand_path(conn, path);
 	/* No protocol extension */