On Sat, 2 Oct 2010, Julien Chaffraix wrote:

> I have this feeling too as the check you added in ssh.c should not be hit on
> linux for such a small value (IIRC curl_off_t is 8 bytes on any linux
> platform). It does not mean we are not doing something wrong though. Looking
> at this line (ssh.c:1914), there is several flaws that could bite us later:
>
> curl_off_t size = attrs.filesize;
>
> curl_off_t is a *signed* 64-bit value which can fall back to a 32-bit value
> (according to curlbuild.h.dist comments). This means that we can overflow
> regardless on the size of curl_off_t on this line (filesize is an unsigned
> 64-bit value).

I agree that the signed vs unsigned is a problem, but I doubt anyone is near
transferring an actual file that is larger than 63 bits. The rest should be
possible to do right still.

There's also this fact that I can't repeat this problem and I've tried with
file sizes above 2GB and above 4GB.

> OK, I was thinking of any other back-end for SFTP to narrow down the issue
> to libssh2 & curl-specific code or escalate to curl.

Right, but libssh2 is the only backend we have for the SSH based protocols so
we can't.

I actually recently checked libssh again (as they are a decently active
project) but their new and updated API is still inadequate for what we need
and want, so there's no other backend alternative in sight.

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html