diff options
author | Daniel Stenberg <daniel@haxx.se> | 2017-09-25 00:35:22 +0200 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-02 07:50:17 +0200 |
commit | 5ff2c5ff25750aba1a8f64fbcad8e5b891512584 (patch) | |
tree | 25b6f46b52aa7271bb3255aa0907e968b024f0ce /lib/ftp.c | |
parent | 440dbcb06e8dedba1551e32046a9415adb82eb0b (diff) | |
download | curl-5ff2c5ff25750aba1a8f64fbcad8e5b891512584.tar.gz |
FTP: zero terminate the entry path even on bad input
... a single double quote could leave the entry path buffer without a zero
terminating byte. CVE-2017-1000254
Test 1152 added to verify.
Reported-by: Max Dymond
Bug: https://curl.haxx.se/docs/adv_20171004.html
Diffstat (limited to 'lib/ftp.c')
-rw-r--r-- | lib/ftp.c | 7 |
1 files changed, 5 insertions, 2 deletions
@@ -2779,6 +2779,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) const size_t buf_size = data->set.buffer_size; char *dir; char *store; + bool entry_extracted = FALSE; dir = malloc(nread + 1); if(!dir) @@ -2810,7 +2811,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) } else { /* end of path */ - *store = '\0'; /* zero terminate */ + entry_extracted = TRUE; break; /* get out of this loop */ } } @@ -2819,7 +2820,9 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) store++; ptr++; } - + *store = '\0'; /* zero terminate */ + } + if(entry_extracted) { /* If the path name does not look like an absolute path (i.e.: it does not start with a '/'), we probably need some server-dependent adjustments. For example, this is the case when connecting to |