d2dc2575e1
overly long directory or file names (CVE-2007-3961 & CVE-2007-3962 from Gentoo CVS via FreeBSD - regen patches while here
64 lines
1.9 KiB
Plaintext
64 lines
1.9 KiB
Plaintext
$OpenBSD: patch-lib_fsplib_fsplib_c,v 1.2 2007/11/06 12:14:18 ajacoutot Exp $
|
|
--- lib/fsplib/fsplib.c.orig Wed Jan 19 03:03:45 2005
|
|
+++ lib/fsplib/fsplib.c Tue Nov 6 13:07:12 2007
|
|
@@ -27,6 +27,14 @@ use of this software.
|
|
#include "fsplib.h"
|
|
#include "lock.h"
|
|
|
|
+#ifndef ENOMSG
|
|
+# define ENOMSG EINVAL
|
|
+#endif
|
|
+
|
|
+#ifndef ENOTSUP
|
|
+# define ENOTSUP EINVAL
|
|
+#endif
|
|
+
|
|
/* ************ Internal functions **************** */
|
|
|
|
/* builds filename in packet output buffer, appends password if needed */
|
|
@@ -612,7 +620,7 @@ int fsp_readdir_r(FSP_DIR *dir,struct dirent *entry, s
|
|
entry->d_reclen = fentry.reclen;
|
|
strncpy(entry->d_name,fentry.name,MAXNAMLEN);
|
|
|
|
- if (fentry.namlen > MAXNAMLEN)
|
|
+ if (fentry.namlen >= MAXNAMLEN)
|
|
{
|
|
entry->d_name[MAXNAMLEN + 1 ] = '\0';
|
|
#ifdef HAVE_NAMLEN
|
|
@@ -680,9 +688,19 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_RDENTRY *entry
|
|
/* skip file date and file size */
|
|
dir->dirpos += 9;
|
|
/* read file name */
|
|
- entry->name[255 + 1] = '\0';
|
|
+ entry->name[255] = '\0';
|
|
strncpy(entry->name,(char *)( dir->data + dir->dirpos ),MAXNAMLEN);
|
|
+ /* check for ASCIIZ encoded filename */
|
|
+ if (memchr(dir->data + dir->dirpos,0,dir->datasize - dir->dirpos) != NULL)
|
|
+ {
|
|
namelen = strlen( (char *) dir->data+dir->dirpos);
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ /* \0 terminator not found at end of filename */
|
|
+ *result = NULL;
|
|
+ return 0;
|
|
+ }
|
|
/* skip over file name */
|
|
dir->dirpos += namelen +1;
|
|
|
|
@@ -709,12 +727,12 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_RDENTRY *entry
|
|
|
|
struct dirent * fsp_readdir(FSP_DIR *dirp)
|
|
{
|
|
- static struct dirent entry;
|
|
+ static dirent_workaround entry;
|
|
struct dirent *result;
|
|
|
|
|
|
if (dirp == NULL) return NULL;
|
|
- if ( fsp_readdir_r(dirp,&entry,&result) )
|
|
+ if ( fsp_readdir_r(dirp,&entry.dirent,&result) )
|
|
return NULL;
|
|
else
|
|
return result;
|