- markus@cvs.openbsd.org 2001/10/01 08:06:28

[scp.c]
     skip filenames containing \n; report jdamery@chiark.greenend.org.uk
     and matthew@debian.org

ChangeLog

@@ -20,6 +20,10 @@
    - markus@cvs.openbsd.org 2001/09/28 15:46:29
      [ssh.c]
      bug: read user config first; report kaukasoi@elektroni.ee.tut.fi
+   - markus@cvs.openbsd.org 2001/10/01 08:06:28
+     [scp.c]
+     skip filenames containing \n; report jdamery@chiark.greenend.org.uk
+     and matthew@debian.org
 
 20011001
  - (stevesk) loginrec.c: fix type conversion problems exposed when using
@@ -6612,4 +6616,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1575 2001/10/03 17:22:29 mouring Exp $
+$Id: ChangeLog,v 1.1576 2001/10/03 17:30:58 mouring Exp $

scp.c

@@ -75,7 +75,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: scp.c,v 1.84 2001/09/19 19:24:19 stevesk Exp $");
+RCSID("$OpenBSD: scp.c,v 1.85 2001/10/01 08:06:28 markus Exp $");
 
 #include "xmalloc.h"
 #include "atomicio.h"
@@ -503,6 +503,11 @@ source(argc, argv)
 		len = strlen(name);
 		while (len > 1 && name[len-1] == '/')
 			name[--len] = '\0';
+		if (strchr(name, '\n') != NULL) {
+			run_err("%s: skipping, filename contains a newline",
+			    name);
+			goto next;
+		}
 		if ((fd = open(name, O_RDONLY, 0)) < 0)
 			goto syserr;
 		if (fstat(fd, &stb) < 0) {