search for: allocbuf

When copying from a remote host to a local filesystem with a strange block size, allocbuf() in scp.c seems to calculate an incorrect buffer size, causing the copy loop in sink() to write past the end of the buffer. For example, with smbfs, the optimal block size is negotiated when the client connects to the server, and is rarely a power of two. In my case it is 64560. This loop in sin...

If the source and destination file are identical, the receiving scp truncates the file. On the sending end, read() returns 0, and garbage is sent instead of actual data, and the receiving end puts it into the file, which at least confuses the users. -- Florian Weimer Florian.Weimer at RUS.Uni-Stuttgart.DE University of Stuttgart http://cert.uni-stuttgart.de/

...1050,1055 **** --- 1054,1064 ---- bad: fprintf(stderr, "%s: invalid user name\n", cp0); return (0); } + + + #if defined(__QNX__) && !defined(__QNXNTO__) + #define st_blksize st_size /* other naming under QNX */ + #endif /* __QNX__ && !__QNX_NTO__ */ BUF * allocbuf(bp, fd, blksize) diff -cr openssh-2.2.0p1.orig/session.c openssh-2.2.0p1.qnx/session.c *** openssh-2.2.0p1.orig/session.c Wed Aug 30 00:21:22 2000 --- openssh-2.2.0p1.qnx/session.c Tue Sep 12 09:27:19 2000 *************** *** 1861,1863 **** --- 1861,1874 ---- if (xauthfile) xauthfile_cleanup...

...process so it can continue sending data from + * the right position */ + i = statbytes = lseek(ofd, 0, SEEK_END); + + snprintf(buf, sizeof(buf), "%llu", i); + (void) atomicio(write, remout, buf, 20); } - (void) atomicio(write, remout, "", 1); + if ((bp = allocbuf(&buffer, ofd, 4096)) == NULL) { (void) close(ofd); continue; @@ -828,8 +956,7 @@ totalbytes = size; progressmeter(-1); } - statbytes = 0; - for (count = i = 0; i < size; i += 4096) { + for (count = 0; i < size; i += 4096) { amt = 4096; if (i + amt > size)...