tags 500279 + patch security clone 500279 -1 reassign -1 ftpd-ssl thanks Unfortunately this came in just as I was going on VAC. Whoever fixes this in linux-ftpd please NMU linux-ftpd-ssl as well. If nobody NMUs, I'll fix this in linux-ftpd-ssl after I get back from VAC.
The attached patch is a port of the openbsd fix to linux-ftpd-ssl, but it also applies to the vanilla linux-ftpd (with offsets) Please note I haven't had time to do more than test that the fix compiles, so please test before uploading. Ian -- Ian Beckwith - [EMAIL PROTECTED] - http://erislabs.net/ianb/ GPG fingerprint: AF6C C0F1 1E74 424B BCD5 4814 40EC C154 A8BA C1EA
diff --git a/ftpd/extern.h b/ftpd/extern.h index fe819c2..0178b35 100644 --- a/ftpd/extern.h +++ b/ftpd/extern.h @@ -43,7 +43,7 @@ void dologout __P((int)); void fatal __P((const char *)); int ftpd_pclose __P((FILE *)); FILE *ftpd_popen __P((char *, const char *)); -char *ftpd_getline __P((char *, int, FILE *)); +int ftpd_getline __P((char *, int, FILE *)); void ftpdlogwtmp __P((const char *, const char *, const char *)); void lreply __P((int, const char *, ...)); void makedir __P((char *)); diff --git a/ftpd/ftpcmd.y b/ftpd/ftpcmd.y index 1af612f..f833735 100644 --- a/ftpd/ftpcmd.y +++ b/ftpd/ftpcmd.y @@ -981,7 +981,7 @@ static struct tab *lookup(struct tab *p, char *cmd) /* * getline - a hacked up version of fgets to ignore TELNET escape codes. */ -char * ftpd_getline(char *s, int n, FILE *iop) +int ftpd_getline(char *s, int n, FILE *iop) { int c; register char *cs; @@ -996,7 +996,7 @@ char * ftpd_getline(char *s, int n, FILE *iop) if (debug) syslog(LOG_FTP | LOG_DEBUG, "command: %s", s); tmpline[0] = '\0'; - return(s); + return(0); } if (c == 0) tmpline[0] = '\0'; @@ -1038,11 +1038,22 @@ char * ftpd_getline(char *s, int n, FILE *iop) } } *cs++ = c; - if (--n <= 0 || c == '\n') + if (--n <= 0) { + /* + * If command doesn't fit into buffer, discard the + * rest of the command and indicate truncation. + * This prevents the command to be split up into + * multiple commands. + */ + while (c != '\n' && (c = GETC(iop)) != EOF) + ; + return (-2); + } + if (c == '\n') break; } if (c == EOF && cs == s) - return (NULL); + return (-1); *cs++ = '\0'; if (debug) { if (!guest && strncasecmp("pass ", s, 5) == 0) { @@ -1062,7 +1073,7 @@ char * ftpd_getline(char *s, int n, FILE *iop) syslog(LOG_FTP | LOG_DEBUG, "command: %.*s", len, s); } } - return (s); + return (0); } void toolong(int signo) @@ -1091,9 +1102,14 @@ static int yylex(void) case CMD: (void) signal(SIGALRM, toolong); (void) alarm((unsigned) timeout); - if (ftpd_getline(cbuf, sizeof(cbuf)-1, stdin)==NULL) { - reply(221, "You could at least say goodbye."); - dologout(0); + n=ftpd_getline(cbuf, sizeof(cbuf)-1, stdin) + if (n == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); + } else if (n == -2) { + reply(500, "Command too long."); + alarm(0); + continue; } (void) alarm(0); if ((cp = strchr(cbuf, '\r'))) { diff --git a/ftpd/ftpd.c b/ftpd/ftpd.c index 8d60811..eed3f50 100644 --- a/ftpd/ftpd.c +++ b/ftpd/ftpd.c @@ -2590,6 +2590,7 @@ void dologout(int status) static void myoob(int signo) { char *cp; + int ret; int save_errno = errno; (void)signo; @@ -2598,9 +2599,13 @@ static void myoob(int signo) if (!transflag) return; cp = tmpline; - if (ftpd_getline(cp, 7, stdin) == NULL) { + ret=ftpd_getline(cp, 7, stdin); + if (ret == -1) { reply(221, "You could at least say goodbye."); dologout(0); + } else if (ret == -2) { + /* Ignore truncated command */ + return; } upper(cp); if (strcmp(cp, "ABOR\r\n") == 0) {