romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 15:13:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

FTP: zero terminate the entry path even on bad input

Browse source 
... a single double quote could leave the entry path buffer without a zero
terminating byte. CVE-2017-1000254

Test 1152 added to verify.

Reported-by: Max Dymond
Bug: https://curl.haxx.se/docs/adv_20171004.html
This commit is contained in:
Daniel Stenberg 2017-09-25 00:35:22 +02:00
parent 440dbcb06e
commit 5ff2c5ff25
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 67 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/ftp.c
View file

@ -2779,6 +2779,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
const size_t buf_size = data->set.buffer_size;
char *dir;
char *store;
bool entry_extracted = FALSE;
dir = malloc(nread + 1);
if(!dir)
@ -2810,7 +2811,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
}
else {
/* end of path */
*store = '\0'; /* zero terminate */
entry_extracted = TRUE;
break; /* get out of this loop */
}
}
@ -2819,7 +2820,9 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
store++;
ptr++;
}
*store = '\0'; /* zero terminate */
}
if(entry_extracted) {
/* If the path name does not look like an absolute path (i.e.: it
does not start with a '/'), we probably need some server-dependent
adjustments. For example, this is the case when connecting to