romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 16:17:21 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftplistparser: protect more cases decrementing 'len'

Browse source 
So that they never wrap. More Coverity remarks.

Closes #17406
This commit is contained in:
Daniel Stenberg 2025-05-21 12:12:15 +02:00
parent 35e1e7be22
commit 497d3c7b01
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/ftplistparser.c
View file

@ -423,7 +423,8 @@ static CURLcode parse_unix(struct Curl_easy *data,
parser->item_length++;
if(c == '\r') {
parser->item_length--;
curlx_dyn_setlen(&infop->buf, --len);
if(len)
curlx_dyn_setlen(&infop->buf, --len);
}
else if(c == '\n') {
mem[parser->item_length - 1] = 0;
@ -519,7 +520,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
case PL_UNIX_USER:
switch(parser->state.UNIX.sub.user) {
case PL_UNIX_USER_PRESPACE:
if(c != ' ') {
if(c != ' ' && len) {
parser->item_offset = len - 1;
parser->item_length = 1;
parser->state.UNIX.sub.user = PL_UNIX_USER_PARSING;
@ -541,7 +542,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
case PL_UNIX_GROUP:
switch(parser->state.UNIX.sub.group) {
case PL_UNIX_GROUP_PRESPACE:
if(c != ' ') {
if(c != ' ' && len) {
parser->item_offset = len - 1;
parser->item_length = 1;
parser->state.UNIX.sub.group = PL_UNIX_GROUP_NAME;
@ -564,7 +565,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
switch(parser->state.UNIX.sub.size) {
case PL_UNIX_SIZE_PRESPACE:
if(c != ' ') {
if(ISDIGIT(c)) {
if(ISDIGIT(c) && len) {
parser->item_offset = len - 1;
parser->item_length = 1;
parser->state.UNIX.sub.size = PL_UNIX_SIZE_NUMBER;
@ -665,7 +666,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
case PL_UNIX_FILENAME:
switch(parser->state.UNIX.sub.filename) {
case PL_UNIX_FILENAME_PRESPACE:
if(c != ' ') {
if(c != ' ' && len) {
parser->item_offset = len - 1;
parser->item_length = 1;
parser->state.UNIX.sub.filename = PL_UNIX_FILENAME_NAME;
@ -703,7 +704,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
case PL_UNIX_SYMLINK:
switch(parser->state.UNIX.sub.symlink) {
case PL_UNIX_SYMLINK_PRESPACE:
if(c != ' ') {
if(c != ' ' && len) {
parser->item_offset = len - 1;
parser->item_length = 1;
parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
@ -754,7 +755,7 @@ static CURLcode parse_unix(struct Curl_easy *data,
parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_NAME;
break;
case PL_UNIX_SYMLINK_PRETARGET4:
if(c != '\r' && c != '\n') {
if(c != '\r' && c != '\n' && len) {
parser->state.UNIX.sub.symlink = PL_UNIX_SYMLINK_TARGET;
parser->item_offset = len - 1;
parser->item_length = 1;
@ -892,6 +893,8 @@ static CURLcode parse_winnt(struct Curl_easy *data,
break;
case PL_WINNT_FILENAME_CONTENT:
parser->item_length++;
if(!len)
return CURLE_FTP_BAD_FILE_LIST;
if(c == '\r') {
parser->state.NT.sub.filename = PL_WINNT_FILENAME_WINEOL;
mem[len - 1] = 0;