From 602fc213aeda9e9bb2879143942d850e000b2ea6 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 29 Apr 2024 13:49:03 +0200 Subject: [PATCH] libssh2: replace `access()` with `stat()` Prefer `stat()` to verify the presence of key files. This drops the last uses of `access()` in the codebase, which was reported to cause issues in some cases. Also add `access()` to the list of banned functions in checksrc. Ref: https://github.com/curl/curl/pull/13412#issuecomment-2065505415 Ref: https://github.com/curl/curl/pull/13482#issuecomment-2078980522 Ref: #13497 Co-authored-by: Jay Satiro Closes #13498 --- lib/vssh/libssh2.c | 9 +++++---- scripts/checksrc.pl | 3 ++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c index 6c5704b6a4..39d4169faf 100644 --- a/lib/vssh/libssh2.c +++ b/lib/vssh/libssh2.c @@ -1086,6 +1086,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) /* To ponder about: should really the lib be messing about with the HOME environment variable etc? */ char *home = curl_getenv("HOME"); + struct_stat sbuf; /* If no private key file is specified, try some common paths. */ if(home) { @@ -1093,12 +1094,12 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) sshc->rsa = aprintf("%s/.ssh/id_rsa", home); if(!sshc->rsa) out_of_memory = TRUE; - else if(access(sshc->rsa, R_OK) != 0) { + else if(stat(sshc->rsa, &sbuf)) { Curl_safefree(sshc->rsa); sshc->rsa = aprintf("%s/.ssh/id_dsa", home); if(!sshc->rsa) out_of_memory = TRUE; - else if(access(sshc->rsa, R_OK) != 0) { + else if(stat(sshc->rsa, &sbuf)) { Curl_safefree(sshc->rsa); } } @@ -1107,10 +1108,10 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block) if(!out_of_memory && !sshc->rsa) { /* Nothing found; try the current dir. */ sshc->rsa = strdup("id_rsa"); - if(sshc->rsa && access(sshc->rsa, R_OK) != 0) { + if(sshc->rsa && stat(sshc->rsa, &sbuf)) { Curl_safefree(sshc->rsa); sshc->rsa = strdup("id_dsa"); - if(sshc->rsa && access(sshc->rsa, R_OK) != 0) { + if(sshc->rsa && stat(sshc->rsa, &sbuf)) { Curl_safefree(sshc->rsa); /* Out of guesses. Set to the empty string to avoid * surprising info messages. */ diff --git a/scripts/checksrc.pl b/scripts/checksrc.pl index 4fc7f1b525..ed3de7c1e4 100755 --- a/scripts/checksrc.pl +++ b/scripts/checksrc.pl @@ -720,7 +720,8 @@ sub scanfile { strtok| v?sprintf| (str|_mbs|_tcs|_wcs)n?cat| - LoadLibrary(Ex)?(A|W)?) + LoadLibrary(Ex)?(A|W)?| + access) \s*\( /x) { checkwarn("BANNEDFUNC", -- 2.47.3