K 10
svn:author
V 6
emaste
K 8
svn:date
V 27
2023-06-06T12:46:25.921216Z
K 7
svn:log
V 1004
sftp: avoid leaking path arg in calls to make_absolute_pwd_glob

As Coverity reports:
    Overwriting tmp in tmp = make_absolute_pwd_glob(tmp, remote_path)
    leaks the storage that tmp points to.

Consume the first arg in make_absolute_pwd_glob, and add xstrdup() to
the one case which did not assign to the same variable that was passed
in. With this change make_absolute() and make_absolute_pwd_glob() have
the same semantics with respect to freeing the input string.

This change was reported to OpenSSH in
https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-November/040497.html
[and was later adopted upstream].

Reported by:	Coverity Scan
CID:		1500409
Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D37253

(cherry picked from commit 69c72a57af843267b220f8367c4cc7162a12d696)
(cherry picked from commit 533a942a213c9e852265f94d27f1e9768294eaa6)

Git Hash:   52503c4477ccba162baca69fb2801f26ff5a5572
Git Author: emaste@FreeBSD.org
END