On Sat, 2 Oct 2010, Julien Chaffraix wrote:

> I found several signed <-> unsigned conversion (usually int to size_t) in
> the security.c code which motivated its rewrite (I fixed some and I tried to
> flag the remaining conversions). For some reason, the compiler will not
> output any warnings for these. Such a conversion would not explain why only
> _some_ servers would show that - that is unless not all the code branches
> are doing it.

Right, and that's what is most puzzling to me. Unless of course the bug is in
a specific libssh2 version that the reporter is using - I've only personally
tried it with the most recent version + the current git.

I kind of get the feeling the problem is in the libssh2 implementation, but
the code that gets the size from remote is really miniscule.

>> Do you also mean that the "curl" tool can download such files in
>> unencrypted format without trouble?
>
> Also does libcurl+openSSH work in this case?

We've focused on comparing SFTP with libcurl+libssh2 and with the OpenSSH tool
'sftp', and as we've found cases where it works with 'sftp' but not with
libcurl+libssh2 I've been satisfied with that and worked towards trying to
find out more details exactly when the libcurl+libssh2 combo gets the problem.

We don't really have a "libcurl+openSSH" combo, as libcurl only does SFTP when
powered by libssh2.

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html