severity 500278 grave thanks Attached is a fixed version of the patch.
This bug should really be severity: grave ('introduces a security hole allowing access to the accounts of users who use the package'). If no-one beats me to it, I'll prepare an NMU soon and ask my AM to upload it. Ian. -- Ian Beckwith - [EMAIL PROTECTED] - http://erislabs.net/ianb/ GPG fingerprint: AF6C C0F1 1E74 424B BCD5 4814 40EC C154 A8BA C1EA Listening to: Mark Lanegan - Field Songs - No Easy Action
diff --git a/ftpd/extern.h b/ftpd/extern.h index fe819c2..0178b35 100644 --- a/ftpd/extern.h +++ b/ftpd/extern.h @@ -43,7 +43,7 @@ void dologout __P((int)); void fatal __P((const char *)); int ftpd_pclose __P((FILE *)); FILE *ftpd_popen __P((char *, const char *)); -char *ftpd_getline __P((char *, int, FILE *)); +int ftpd_getline __P((char *, int, FILE *)); void ftpdlogwtmp __P((const char *, const char *, const char *)); void lreply __P((int, const char *, ...)); void makedir __P((char *)); diff --git a/ftpd/ftpcmd.y b/ftpd/ftpcmd.y index 06a0c64..3c08d77 100644 --- a/ftpd/ftpcmd.y +++ b/ftpd/ftpcmd.y @@ -920,7 +920,7 @@ static struct tab *lookup(struct tab *p, char *cmd) /* * getline - a hacked up version of fgets to ignore TELNET escape codes. */ -char * ftpd_getline(char *s, int n, FILE *iop) +int ftpd_getline(char *s, int n, FILE *iop) { int c; register char *cs; @@ -934,7 +934,7 @@ char * ftpd_getline(char *s, int n, FILE *iop) if (debug) syslog(LOG_FTP | LOG_DEBUG, "command: %s", s); tmpline[0] = '\0'; - return(s); + return(0); } if (c == 0) tmpline[0] = '\0'; @@ -965,11 +965,22 @@ char * ftpd_getline(char *s, int n, FILE *iop) } } *cs++ = c; - if (--n <= 0 || c == '\n') + if (--n <= 0) { + /* + * If command doesn't fit into buffer, discard the + * rest of the command and indicate truncation. + * This prevents the command to be split up into + * multiple commands. + */ + while (c != '\n' && (c = getc(iop)) != EOF) + ; + return (-2); + } + if (c == '\n') break; } if (c == EOF && cs == s) - return (NULL); + return (-1); *cs++ = '\0'; if (debug) { if (!guest && strncasecmp("pass ", s, 5) == 0) { @@ -989,7 +1000,7 @@ char * ftpd_getline(char *s, int n, FILE *iop) syslog(LOG_FTP | LOG_DEBUG, "command: %.*s", len, s); } } - return (s); + return (0); } void toolong(int signo) @@ -1018,9 +1029,14 @@ static int yylex(void) case CMD: (void) signal(SIGALRM, toolong); (void) alarm((unsigned) timeout); - if (ftpd_getline(cbuf, sizeof(cbuf)-1, stdin)==NULL) { - reply(221, "You could at least say goodbye."); - dologout(0); + n=ftpd_getline(cbuf, sizeof(cbuf)-1, stdin); + if (n == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); + } else if (n == -2) { + reply(500, "Command too long."); + alarm(0); + continue; } (void) alarm(0); if ((cp = strchr(cbuf, '\r'))) { diff --git a/ftpd/ftpd.c b/ftpd/ftpd.c index ec70a4e..37945e4 100644 --- a/ftpd/ftpd.c +++ b/ftpd/ftpd.c @@ -2111,6 +2111,7 @@ void dologout(int status) static void myoob(int signo) { char *cp; + int ret; int save_errno = errno; (void)signo; @@ -2119,9 +2120,13 @@ static void myoob(int signo) if (!transflag) return; cp = tmpline; - if (ftpd_getline(cp, 7, stdin) == NULL) { + ret=ftpd_getline(cp, 7, stdin); + if (ret == -1) { reply(221, "You could at least say goodbye."); dologout(0); + } else if (ret == -2) { + /* Ignore truncated command */ + return; } upper(cp); if (strcmp(cp, "ABOR\r\n") == 0) {