misc: Fix format truncation in ssh_path_expand_escape()

error: ‘%u’ directive output may be truncated writing between 1 and 10
bytes into a region of size 6.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>

include/libssh/session.h

@@ -223,7 +223,7 @@ struct ssh_session_struct {
         char *agent_socket;
         unsigned long timeout; /* seconds */
         unsigned long timeout_usec;
-        unsigned int port;
+        uint16_t port;
         socket_t fd;
         int StrictHostKeyChecking;
         char compressionlevel;

src/misc.c

@@ -1237,14 +1237,13 @@ char *ssh_path_expand_escape(ssh_session session, const char *s)
                 }
                 break;
             case 'p':
-                if (session->opts.port < 65536) {
+                if (session->opts.port > 0) {
-                    char tmp[6];
+                  char tmp[6];
 
-                    snprintf(tmp,
+                  snprintf(tmp, sizeof(tmp), "%hu",
-                             sizeof(tmp),
+                           (uint16_t)(session->opts.port > 0 ? session->opts.port
-                             "%u",
+                                                             : 22));
-                             session->opts.port > 0 ? session->opts.port : 22);
+                  x = strdup(tmp);
-                    x = strdup(tmp);
                 }
                 break;
             default: