upstream: set FD_CLOEXEC on the fds between sftp and its ssh

process, avoids risk of subcommands that write on odd fds breaking the
connection. GHPR693 from Manuel Einfalt; feedback deraadt@ ok dtucker@

OpenBSD-Commit-ID: 91b12cd66580dab6b3bfe5e507a1a8310c8f9149

diff --git a/sftp.c b/sftp.c
index db23a578ef4646f9a2a89b78b8c40160c4b07282..a526fade2d338ad727fd31019c3c4aafa63c4ce2 100644 (file)
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.255 2026/06/29 23:00:00 djm Exp $ */
+/* $OpenBSD: sftp.c,v 1.256 2026/06/30 00:10:48 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -327,7 +327,6 @@ local_do_shell(const char *args)
                fatal("Couldn't fork: %s", strerror(errno));
 
        if (pid == 0) {
-               /* XXX: child has pipe fds to ssh subproc open - issue? */
                if (args) {
                        debug3("Executing %s -c \"%s\"", shell, args);
                        execl(shell, shell, "-c", args, (char *)NULL);
@@ -2404,6 +2403,8 @@ connect_to_server(char *path, char **args, int *in, int *out)
        *in = *out = inout[0];
        c_in = c_out = inout[1];
 #endif /* USE_PIPES */
+       FD_CLOSEONEXEC(*in);
+       FD_CLOSEONEXEC(*out);
 
        if ((sshpid = fork()) == -1)
                fatal("fork: %s", strerror(errno));