openbsd-ports/net/gftp/patches/patch-lib_fsplib_fsplib_c
ajacoutot d2dc2575e1 - SECURITY: fix two boundary errors in fsplib code when processing
overly long directory or file names (CVE-2007-3961 & CVE-2007-3962
from Gentoo CVS via FreeBSD
- regen patches while here
2007-11-06 12:14:18 +00:00

64 lines
1.9 KiB
Plaintext

$OpenBSD: patch-lib_fsplib_fsplib_c,v 1.2 2007/11/06 12:14:18 ajacoutot Exp $
--- lib/fsplib/fsplib.c.orig Wed Jan 19 03:03:45 2005
+++ lib/fsplib/fsplib.c Tue Nov 6 13:07:12 2007
@@ -27,6 +27,14 @@ use of this software.
#include "fsplib.h"
#include "lock.h"
+#ifndef ENOMSG
+# define ENOMSG EINVAL
+#endif
+
+#ifndef ENOTSUP
+# define ENOTSUP EINVAL
+#endif
+
/* ************ Internal functions **************** */
/* builds filename in packet output buffer, appends password if needed */
@@ -612,7 +620,7 @@ int fsp_readdir_r(FSP_DIR *dir,struct dirent *entry, s
entry->d_reclen = fentry.reclen;
strncpy(entry->d_name,fentry.name,MAXNAMLEN);
- if (fentry.namlen > MAXNAMLEN)
+ if (fentry.namlen >= MAXNAMLEN)
{
entry->d_name[MAXNAMLEN + 1 ] = '\0';
#ifdef HAVE_NAMLEN
@@ -680,9 +688,19 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_RDENTRY *entry
/* skip file date and file size */
dir->dirpos += 9;
/* read file name */
- entry->name[255 + 1] = '\0';
+ entry->name[255] = '\0';
strncpy(entry->name,(char *)( dir->data + dir->dirpos ),MAXNAMLEN);
+ /* check for ASCIIZ encoded filename */
+ if (memchr(dir->data + dir->dirpos,0,dir->datasize - dir->dirpos) != NULL)
+ {
namelen = strlen( (char *) dir->data+dir->dirpos);
+ }
+ else
+ {
+ /* \0 terminator not found at end of filename */
+ *result = NULL;
+ return 0;
+ }
/* skip over file name */
dir->dirpos += namelen +1;
@@ -709,12 +727,12 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_RDENTRY *entry
struct dirent * fsp_readdir(FSP_DIR *dirp)
{
- static struct dirent entry;
+ static dirent_workaround entry;
struct dirent *result;
if (dirp == NULL) return NULL;
- if ( fsp_readdir_r(dirp,&entry,&result) )
+ if ( fsp_readdir_r(dirp,&entry.dirent,&result) )
return NULL;
else
return result;