From f1828b54047dba804d04e4c0ebd402c6e9a11533 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 13 Oct 2025 09:40:38 +0200
Subject: [PATCH] libssh2: avoid risking using an uninitialized local struct
 field

Reported-by: Joshua Rogers
Closes #19043
---
 lib/vssh/libssh2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
index dfdb8526d6..ee468bb359 100644
--- a/lib/vssh/libssh2.c
+++ b/lib/vssh/libssh2.c
@@ -1428,6 +1428,7 @@ sftp_download_stat(struct Curl_easy *data,
     data->req.size = -1;
     data->req.maxdownload = -1;
     Curl_pgrsSetDownloadSize(data, -1);
+    attrs.filesize = 0; /* might be uninitialized but will be read below */
   }
   else {
     curl_off_t size = attrs.filesize;
-- 
2.47.3