Protect a remote filename that starts with a dash.

diff --git a/clientserver.c b/clientserver.c
index afd2b179a50c9bcf2c124a27f2bd185124a0ec14..21ef01c5813fb75243b60915c520052e0968aa7e 100644 (file)
--- a/clientserver.c
+++ b/clientserver.c
@@ -265,7 +265,10 @@ int start_inband_exchange(int f_in, int f_out, const char *user, int argc, char
                if (strncmp(*argv, modname, modlen) == 0
                 && argv[0][modlen] == '\0')
                        sargs[sargc++] = modname; /* we send "modname/" */
-               else
+               else if (**argv == '-') {
+                       if (asprintf(sargs + sargc++, "./%s", *argv) < 0)
+                               out_of_memory("start_inband_exchange");
+               } else
                        sargs[sargc++] = *argv;
                argv++;
                argc--;

diff --git a/main.c b/main.c
index 161bfad89c8bf9ff1390379d53f08a90fc1628c5..649aa90416715e97c0798a86d519e9046889b8cb 100644 (file)
--- a/main.c
+++ b/main.c
@@ -493,7 +493,11 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char **remote_argv, in
                                rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
                                exit_cleanup(RERR_SYNTAX);
                        }
-                       args[argc++] = *remote_argv++;
+                       if (**remote_argv == '-') {
+                               if (asprintf(args + argc++, "./%s", *remote_argv++) < 0)
+                                       out_of_memory("do_cmd");
+                       } else
+                               args[argc++] = *remote_argv++;
                        remote_argc--;
                }
        }