When doing a get or put of a quoted filename, sftp misinterprets the location of the terminating quote. In sftp-int.c, when the terminating quote is located, the path is NUL terminated, but the location counter is not updated, causing the source filename's end quote to be interpreted as the opening quote of a destination filename. This causes 'get "filename"' to fail with an Unterminated quote error, and causes 'get "src-filename" "dest-filename"' to write src-filename to a file named " " rather than dest-filename. Unquoted transfer commands--e.g., get src-filename dest-filename-- are not affected.
Created attachment 437 [details] Patch fixing increment bug in get_pathname function of sftp-int.c
Fixed in OpenSSH 3.7.1p2.
Mass change of RESOLVED bugs to CLOSED