diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2017-10-19 14:41:14 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-20 15:06:25 +0200 |
| commit | 769647e714b8da41bdb72720bf02dce56033e02e (patch) | |
| tree | 3d82a374ee3f68721515637042a5bd01b4ebbbdb | |
| parent | 8351ab45105c3e58c38205c045477198ff887829 (diff) | |
| download | curl-769647e714b8da41bdb72720bf02dce56033e02e.tar.gz | |
ftp: reject illegal IP/port in PASV 227 response
... by using range checks. Among other things, this avoids an undefined
behavior for a left shift that could happen on negative or very large
values.
Closes #1997
Detected by OSS-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3694
| -rw-r--r-- | lib/ftp.c | 9 | ||||
| -rw-r--r-- | tests/data/test237 | 8 |
2 files changed, 7 insertions, 10 deletions
@@ -1874,8 +1874,8 @@ static CURLcode ftp_state_pasv_resp(struct connectdata *conn, else if((ftpc->count1 == 1) && (ftpcode == 227)) { /* positive PASV response */ - int ip[4]; - int port[2]; + unsigned int ip[4]; + unsigned int port[2]; /* * Scan for a sequence of six comma-separated numbers and use them as @@ -1887,14 +1887,15 @@ static CURLcode ftp_state_pasv_resp(struct connectdata *conn, * "227 Entering passive mode. 127,0,0,1,4,51" */ while(*str) { - if(6 == sscanf(str, "%d,%d,%d,%d,%d,%d", + if(6 == sscanf(str, "%u,%u,%u,%u,%u,%u", &ip[0], &ip[1], &ip[2], &ip[3], &port[0], &port[1])) break; str++; } - if(!*str) { + if(!*str || (ip[0] > 255) || (ip[1] > 255) || (ip[2] > 255) || + (ip[3] > 255) || (port[0] > 255) || (port[1] > 255) ) { failf(data, "Couldn't interpret the 227-response"); return CURLE_FTP_WEIRD_227_FORMAT; } diff --git a/tests/data/test237 b/tests/data/test237 index 9a40f1f6b..e9147dcd1 100644 --- a/tests/data/test237 +++ b/tests/data/test237 @@ -30,13 +30,9 @@ ftp://%HOSTIP:%FTPPORT/237 --disable-epsv # certain hosts with buggy resolver code, the resulting address (192.0.2.127) # is from an address block that is guaranteed never to be assigned (RFC3330). <verify> -# curl: (15) Can't resolve new host 1216.256.2.127:32639 -# 15 => CURLE_FTP_CANT_GET_HOST -# some systems just don't fail on the illegal host name/address but instead -# moves on and attempt to connect to... yes, to what? -# 7= CURLE_COULDNT_CONNECT +# 14 = CURLE_FTP_WEIRD_227_FORMAT <errorcode> -15, 7 +14 </errorcode> <protocol> USER anonymous
|