--- openssh-3.6.1p2.orig/scp.c	24 Nov 2003 02:09:28 -0000	1.125

+++ openssh-3.6.1p2/scp.c	19 Apr 2004 13:50:16 -0000	1.126

@@ -759,6 +759,8 @@ sink(int argc, char **argv)

 			*cp++ = ch;

 		} while (cp < &buf[sizeof(buf) - 1] && ch != '\n');

 		*cp = 0;

+		if (verbose_mode)

+			fprintf(stderr, "Sink: %s", buf);

 		if (buf[0] == '\01' || buf[0] == '\02') {

 			if (iamremote == 0)

@@ -822,6 +824,10 @@ sink(int argc, char **argv)

 			size = size * 10 + (*cp++ - '0');

 		if (*cp++ != ' ')

 			SCREWUP("size not delimited");

+		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {

+			run_err("error: unexpected filename: %s", cp);

+			exit(1);

+		}

 		if (targisdir) {

 			static char *namebuf;

 			static int cursize;

@@ -843,6 +849,8 @@ sink(int argc, char **argv)

 		exists = stat(np, &stb) == 0;

 		if (buf[0] == 'D') {

 			int mod_flag = pflag;

+			if (!iamrecursive)

+				SCREWUP("received directory without -r");

 			if (exists) {

 				if (!S_ISDIR(stb.st_mode)) {

 					errno = ENOTDIR;