openssh bugs - Nov 2005 - [Bug 1120] sftp deletes files if destination==source and client==server

http://bugzilla.mindrot.org/show_bug.cgi?id=1120

           Summary: sftp deletes files if destination==source and
                    client==server
           Product: Portable OpenSSH
           Version: 3.9p1
          Platform: ix86
        OS/Version: Linux
            Status: NEW
          Severity: critical
          Priority: P2
         Component: sftp
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: 1useaccount_84 at mailinator.com


If one inadvertently does a "self-connection" (i.e., from the client
machine
"mymachine" types "sftp mymachine"), logs in, and then
"put foo", sftp
transfers the file foo **leaving it empty** (0 bytes), therefore producing data
loss.

Maybe it is easier with an example:
++++++++++++++++++++++++++++++++++++++++++++
user at mymachine:~$ ls -l foo
-rw-rw-r--  1 user user 550 Nov 17 18:29 foo
user at mymachine:~$ sftp mymachine
Connecting to mymachine...
user at mymachine's password:
sftp> put foo
Uploading foo to /home/user/foo
foo                                             0%    0     0.0KB/s   --:-- ETA
sftp> quit
user at mymachine:~$ ls -l foo
-rw-rw-r--  1 user user 0 Nov 17 18:30 foo
+++++++++++++++++++++++++++++++++++++++++++++




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1120





------- Comment #1 from fcusack at fcusack.com  2005-11-18 05:14 -------
How is this a bug???  It's like saying 'cp foo foo' is a bug.  I
guess the
server
side could write to a tmp file (like rsync would do), but severity seems like
it should be trivial at best




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.