From d888a53e14597f0fd252f14d8595b1e9adb7bcf5 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 1 Apr 2026 15:31:48 +0200
Subject: [PATCH] libssh: path length precaution

Make sure the string is non-zero before indexing it -1. Right now, the
path is always non-zero length so this is more for (future) safety
reasons.

Closes #21193
---
 lib/vssh/libssh.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
index 13a987dec7..06e1915951 100644
--- a/lib/vssh/libssh.c
+++ b/lib/vssh/libssh.c
@@ -2029,7 +2029,9 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data,
       if(data->state.upload)
         myssh_to(data, sshc, SSH_SFTP_UPLOAD_INIT);
       else if(sshp) {
-        if(sshp->path[strlen(sshp->path) - 1] == '/')
+        size_t path_len = strlen(sshp->path);
+
+        if(path_len && sshp->path[path_len - 1] == '/')
           myssh_to(data, sshc, SSH_SFTP_READDIR_INIT);
         else
           myssh_to(data, sshc, SSH_SFTP_DOWNLOAD_INIT);