Uninitialized data access via handle mis-parsing

Uninitialized pointer access in ewxrjk sftpserver allows remote authenticated users to affect a server through a malformed handle. The sftp_parse_handle function combines a length check with handle parsing so that a bad length can return an uninitialized rc value; the patch separates the checks and returns SSH_FX_BAD_MESSAGE for a non-eight-byte handle. Reachability requires deployment on a security boundary, such as a direct TCP listener or restricted-login command, and the maintainer disputes vulnerability status because the README warns against those configurations.