Strength the defense against malicious command-line arguments in the

sqlite3_rsync utility program.

FossilOrigin-Name: a8d18783fb2dbe9683bb6f3b57ebb3cc3ccf1e5afdd5e14786abf1e4e240f51a

manifest

@@ -1,5 +1,5 @@
-C Fix\sHTML\s">"\squoting\sin\sQRF.
-D 2026-05-25T23:47:05.001
+C Strength\sthe\sdefense\sagainst\smalicious\scommand-line\sarguments\sin\sthe\nsqlite3_rsync\sutility\sprogram.
+D 2026-05-26T11:46:58.901
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -2179,7 +2179,7 @@ F tool/spellsift.tcl 52b4b04dc4333c7ab024f09d9d66ed6b6f7c6eb00b38497a09f338fa55d
 F tool/split-sqlite3c.tcl 4969fd642dad0ea483e4e104163021d92baf98f6a8eac981fe48525f9b873430
 F tool/sqldiff.c 847edc1e0d1e1feb652d3d6128e504456deaf254ab9ad3e7cebd4317d2037182
 F tool/sqlite3_analyzer.c.in 14f02cb5ec3c264cd6107d1f1dad77092b1cf440fc196c30b69ae87b56a1a43b
-F tool/sqlite3_rsync.c f510a8b230e1c5b0f62842acd0e94ff15d2f77a00ae782f7d20f9e39919fa19b
+F tool/sqlite3_rsync.c d9ce999e5b3aa9f36de44b321755622e52258774889bd804ba56f00eca01af50
 F tool/sqltclsh.c.in c103c6fc7d42bce611f9d4596774d60b7ef3d0b291a1f58c9e6184e458b89296
 F tool/sqltclsh.tcl 862f4cf1418df5e1315b5db3b5ebe88969e2a784525af5fbf9596592f14ed848
 F tool/src-verify.c 6c655d9a8d6b30f3648fc78a79bf3838ed68f8543869d380c43ea9f17b3b8501
@@ -2198,9 +2198,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 73dfb252f86807464642037df6ec7353b5b52d8c447837c7c4a6540ec622f29d
-Q +5cee1097b47d850989ebecdb9d2c814e6968240fe3bacb5598ca85067cb95692
-R 739212c4347c401b65b6b4d02bb4d6f3
+P f6b35a9b5fc38245414f1bea9bc3c81b57f774711e77ab32fb91c984370ed5e9
+Q +c84d596b6da22061627282d444913c88dc2f9bd82e86957183f7e732f2713b33
+R aeeb5c5c125784d05570ba7ef87aeb1d
 U drh
-Z b5f046fda3fb6ae1716e1a1d76d44abd
+Z a9687bde109491b13261cd91ff980deb
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-f6b35a9b5fc38245414f1bea9bc3c81b57f774711e77ab32fb91c984370ed5e9
+a8d18783fb2dbe9683bb6f3b57ebb3cc3ccf1e5afdd5e14786abf1e4e240f51a

tool/sqlite3_rsync.c

@@ -2193,7 +2193,7 @@ int main(int argc, char const * const *argv){
       printf("%s\n", sqlite3_str_value(pStr));
       return 0;
     }
-    if( z[i]=='-' ){
+    if( z[0]=='-' ){
       fprintf(stderr,
          "unknown option: \"%s\". Use --help for more detail.\n", z);
       return 1;
@@ -2262,7 +2262,7 @@ int main(int argc, char const * const *argv){
       append_escaped_arg(pStr, zSsh, 1);
       if( iPort>0 ) sqlite3_str_appendf(pStr, " -p %d", iPort);
       sqlite3_str_appendf(pStr, " -e none");
-      append_escaped_arg(pStr, ctx.zOrigin, 0);
+      append_escaped_arg(pStr, ctx.zOrigin, 1);
       if( iRetry ) add_path_argument(pStr);
       append_escaped_arg(pStr, zExe, 1);
       append_escaped_arg(pStr, "--origin", 0);
@@ -2311,7 +2311,7 @@ int main(int argc, char const * const *argv){
       append_escaped_arg(pStr, zSsh, 1);
       if( iPort>0 ) sqlite3_str_appendf(pStr, " -p %d", iPort);
       sqlite3_str_appendf(pStr, " -e none");
-      append_escaped_arg(pStr, ctx.zReplica, 0);
+      append_escaped_arg(pStr, ctx.zReplica, 1);
       if( iRetry==1 ) add_path_argument(pStr);
       append_escaped_arg(pStr, zExe, 1);
       append_escaped_arg(pStr, "--replica", 0);