Debian Bug report logs - #51955
scping localhost:<file> <file> destroys <file>

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Dale E. Martin" <dmartin@clifton-labs.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: scping localhost:<file> <file> corrupts <file>

Date: Sun, 05 Dec 1999 06:35:43 -0500

Package: ssh
Version: 1:1.2pre13-1
Severity: normal

I just corrupted my .bash\* files by forgetting what window I was in for a 
moment :-(  The non-free ssh figures out that it's the same file and stops
you before it tries to copy anything.  

Just as clarification, I was in my home dir on chinchilla, and I did this:
~> scp chinchilla:.bash\* .

It said "I/O error" and now those files are full of binary stuff.

-- System Information
Debian Release: potato
Architecture: i386
Kernel: Linux chinchilla 2.2.13 #1 SMP Tue Nov 16 21:19:34 EST 1999 i686

Versions of packages ssh depends on:
ii  libc6                         2.1.2-10   GNU C Library: Shared libraries an
ii  libpam-modules                0.71-1     Pluggable Authentication Modules f
ii  libpam0g                      0.71-1     Pluggable Authentication Modules l
ii  libssl09                      0.9.4-3    SSL shared libraries              
ii  libwrap0                      7.6-1.1    Wietse Venema's TCP wrappers libra
ii  zlib1g [libz1]                1:1.1.3-5  compression library - runtime     

-- Configuration Files:
/etc/ssh/ssh_config changed [not included]

Message #10 received at 51955@bugs.debian.org (full text, mbox, reply):

From: Christian Kurz <shorty@debian.org>

To: "Dale E. Martin" <dmartin@clifton-labs.com>

Cc: 51955@bugs.debian.org

Subject: Re: scping localhost:<file> <file> corrupts <file>

Date: Wed, 27 Dec 2000 20:52:23 +0100

[Message part 1 (text/plain, inline)]

> Package: ssh
> Version: 1:1.2pre13-1
> Severity: normal

> I just corrupted my .bash\* files by forgetting what window I was in for a 
> moment :-(  The non-free ssh figures out that it's the same file and stops
> you before it tries to copy anything.  

> Just as clarification, I was in my home dir on chinchilla, and I did this:
> ~> scp chinchilla:.bash\* .

> It said "I/O error" and now those files are full of binary stuff.

This bug should be solved in the ssh-package that is available in
testing. Could you please verify this, so that we can close this
bugreport now?

Ciao
     Christian
-- 
          Debian Developer and Quality Assurance Team Member
    1024/26CC7853 31E6 A8CA 68FC 284F 7D16  63EC A9E6 67FF 26CC 7853

[Message part 2 (application/pgp-signature, inline)]

Message #15 received at 51955@bugs.debian.org (full text, mbox, reply):

From: Ian Jackson <ian@davenant.greenend.org.uk>

To: 51955@bugs.debian.org

Subject: Fix to the actual bug

Date: Thu, 23 Aug 2001 01:22:31 +0100 (BST)

There is a remotely potential security problem here, and in any case a
clear bug, in that in some circumstances (mainly involving races) scp
can be induced to copy random junk from its innards into destination
files.

The diff below causes the files to end up with nul bytes in instead.
It does not attempt to detect the `copy file onto itself' usage error,
which will still usually result in the destruction of the file.

Ian.

--- scp.c~	Thu Aug 23 00:10:58 2001
+++ scp.c	Thu Aug 23 01:10:47 2001
@@ -571,8 +571,11 @@
 				amt = stb.st_size - i;
 			if (!haderr) {
 				result = atomicio(read, fd, bp->buf, amt);
-				if (result != amt)
+				if (result != amt) {
 					haderr = result >= 0 ? EIO : errno;
+					result = result >= 0 ? result : 0;
+					memset(bp->buf+result, 0, amt-result);
+				}
 			}
 			if (haderr)
 				(void) atomicio(write, remout, bp->buf, amt);

Message #24 received at 51955@bugs.debian.org (full text, mbox, reply):

From: mouring <mouring@etoh.eviladmin.org>

To: 51955@bugs.debian.org

Subject: scping localhost:<file> <file> corrupts <file>

Date: Mon, 28 Jan 2002 12:20:58 -0600 (CST)

This has been fixed in OpenSSH for a while now (5/19/2001).  3.0.2pX should
work fine.

Patch applied:

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.70&r2=1.71 
- Ben

Message #29 received at 51955-done@bugs.debian.org (full text, mbox, reply):

From: Matthew Vernon <matthew@sel.cam.ac.uk>

To: 51955-done@bugs.debian.org

Subject: fixed upstream

Date: Tue, 29 Jan 2002 13:44:10 +0000

Upstream inform me this bug has been fixed.

Matthew

-- 
Rapun.sel - outermost outpost of the Pick Empire
http://www.pick.ucam.org

Send a report that this bug log contains spam.