SFTP: more ignoring negative file sizes

As the change in 5f0ae7a0626cbe709 added a precaution against negative
file sizes that for some reason managed to get returned, this change now
introduces the same check at the second place in the code where the file
size from the libssh2 stat call is used.

This check might not be suitable for a 32 bit curl_off_t, but libssh2.h
assumes long long to work and to be 64 bit so I believe such a small
curl_off_t will be very unlikely to occur in the wild.

diff --git a/lib/ssh.c b/lib/ssh.c
index 026212103ead6004956a4af77ef233c9b0077e7d..314d89843145882ebb4b2fbeca2f102c54e2c34f 100644 (file)
--- a/lib/ssh.c
+++ b/lib/ssh.c
@@ -1442,6 +1442,11 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
             data->state.resume_from = 0;
           }
           else {
+            curl_off_t size = attrs.filesize;
+            if(size < 0) {
+              failf(data, "Bad file size (%" FORMAT_OFF_T ")", size);
+              return CURLE_BAD_DOWNLOAD_RESUME;
+            }
             data->state.resume_from = attrs.filesize;
           }
         }