scp: fix directory name length used in memcpy

Fix read off end of array due to bad pointer math in getworkingpath for
SCP home directory case.

Closes #4258

diff --git a/lib/curl_path.c b/lib/curl_path.c
index 85dddcef1b4a9446ed7122157184d01d97b1c1cf..f429634630aad68cdf1d6280524da0a6551ab34f 100644 (file)
--- a/lib/curl_path.c
+++ b/lib/curl_path.c
@@ -55,7 +55,7 @@ CURLcode Curl_getworkingpath(struct connectdata *conn,
     }
     if((working_path_len > 3) && (!memcmp(working_path, "/~/", 3)))
       /* It is referenced to the home directory, so strip the leading '/~/' */
-      memcpy(real_path, working_path + 3, 4 + working_path_len-3);
+      memcpy(real_path, working_path + 3, working_path_len - 2);
     else
       memcpy(real_path, working_path, 1 + working_path_len);
   }