don't silently ignore extra flag arguments

cli-runopts.c

@@ -218,8 +218,12 @@ void cli_getopts(int argc, char ** argv) {
 
 		if (argv[i][0] == '-') {
 			/* A flag *waves* */
-
-			switch (argv[i][1]) {
+			char c = argv[i][1];
+			if (strlen(argv[i]) != 2) {
+				/* Ensure only one flag per hyphen. '?' falls through to print help */
+				c = '?';
+			}
+			switch (c) {
 				case 'y': /* always accept the remote hostkey */
 					if (cli_opts.always_accept_key) {
 						/* twice means no checking at all */

dbclient.1

@@ -3,7 +3,7 @@
 dbclient \- lightweight SSH client
 .SH SYNOPSIS
 .B dbclient
-[\-Tt] [\-p
+[flag arguments] [\-p
 .I port\fR] [\-i
 .I id\fR] [\-L
 .I l\fR:\fIh\fR:\fIr\fR] [\-R

dropbear.8

@@ -3,7 +3,7 @@
 dropbear \- lightweight SSH server
 .SH SYNOPSIS
 .B dropbear
-[\-RFEmwsgjki] [\-b
+[flag arguments] [\-b
 .I banner\fR] 
 [\-r
 .I hostkeyfile\fR] [\-p

svr-runopts.c

@@ -189,7 +189,12 @@ void svr_getopts(int argc, char ** argv) {
 		}
 
 		if (argv[i][0] == '-') {
-			switch (argv[i][1]) {
+			char c = argv[i][1];
+			if (strlen(argv[i]) != 2) {
+				/* Ensure only one flag per hyphen. '?' falls through to print help */
+				c = '?';
+			}
+			switch (c) {
 				case 'b':
 					next = &svr_opts.bannerfile;
 					break;