Re: Missing check in ftp(1)

Previous thread: -Bilgi!! by P.Merkezi on Monday, December 28, 2009 - 6:11 pm. (1 message)

Next thread: Add support for sysconf(3) _SC_NPROCESSORS_CONF / _SC_NPROCESSORS_ONLN by Brad on Monday, December 28, 2009 - 7:45 pm. (3 messages)
From: Alexander Schrijver
Date: Monday, December 28, 2009 - 6:16 pm

If the directory entry isn't complete line can be NULL.

I ran into it using 'mget -r .' on this FTP server:

ftp://ftp.cs.cmu.edu

Index: list.c
===================================================================
RCS file: /home/cvsync/src/usr.bin/ftp/list.c,v
retrieving revision 1.3
diff -u -r1.3 list.c
--- list.c      5 May 2009 19:35:30 -0000       1.3
+++ list.c      29 Dec 2009 00:55:47 -0000
@@ -34,6 +34,8 @@
                        *type = *tok;

                if (field == 7) {
+                       if (line == NULL);
+                               break;
                        while (**line == ' ' || **line == '\t')
                                (*line)++;
                        break;
@@ -58,6 +60,8 @@
                        *type = 'd';

                if (field == 2) {
+                       if (line == NULL);
+                               break;
                        while (**line == ' ' || **line == '\t')
                                (*line)++;
                        break;

From: Alexander Schrijver
Date: Saturday, June 26, 2010 - 2:27 am

Hi,

Repost, i sent this a while back, but i think it got lost.

echo 'mget -r . ' | ftp://ftp.cs.cmu.edu

still segfaults on the latest snapshot.

Index: list.c
===================================================================
RCS file: /home/cvsync/src/usr.bin/ftp/list.c,v
retrieving revision 1.3
diff -u -r1.3 list.c
--- list.c      5 May 2009 19:35:30 -0000       1.3
+++ list.c      29 Dec 2009 00:55:47 -0000
@@ -34,6 +34,8 @@
                        *type = *tok;

                if (field == 7) {
+                       if (line == NULL);
+                               break;
                        while (**line == ' ' || **line == '\t')
                                (*line)++;
                        break;
@@ -58,6 +60,8 @@
                        *type = 'd';

                if (field == 2) {
+                       if (line == NULL);
+                               break;
                        while (**line == ' ' || **line == '\t')
                                (*line)++;
                        break;



From: Peter Hessler
Date: Saturday, June 26, 2010 - 5:04 pm

Hi Alexander



However I did adjust it and came up with this instead, does it also fix
the issue for you?


Index: list.c
===================================================================
RCS file: /cvs/openbsd/src/usr.bin/ftp/list.c,v
retrieving revision 1.3
diff -u -p -u -p -r1.3 list.c
--- list.c	5 May 2009 19:35:30 -0000	1.3
+++ list.c	27 Jun 2010 00:00:06 -0000
@@ -34,6 +34,8 @@ parse_unix(char **line, char *type)
 			*type = *tok;
 
 		if (field == 7) {
+			if (line == NULL || *line == NULL || **line == '\0')
+				break;
 			while (**line == ' ' || **line == '\t')
 				(*line)++;
 			break;
@@ -58,6 +60,8 @@ parse_windows(char **line, char *type)
 			*type = 'd';
 
 		if (field == 2) {
+			if (line == NULL || *line == NULL || **line == '\0')
+				break;
 			while (**line == ' ' || **line == '\t')
 				(*line)++;
 			break;


-- 
Q:  What do you do with an elephant with three balls?
A:  Walk him and pitch to the rhino.

From: Alexander Schrijver
Date: Sunday, June 27, 2010 - 3:41 am

Ugh, that was real sloppy of me. Yes that actually fixes the issue. The fix i intended didn't.

Now it just does nothing, like it is supposed to (The second is with your fix applied):

$ echo 'mget -r . ' | ftp ftp://ftp.cs.cmu.edu     
Segmentation fault (core dumped) 
$ echo 'mget -r . ' | ./ftp ftp://ftp.cs.cmu.edu
$ 

From: Peter Hessler
Date: Sunday, June 27, 2010 - 1:04 pm

This fix was just committed.  Many thanks for the report!

-- 
Katz' Law:
	Man and nations will act rationally when all other
	possibilities have been exhausted.

Previous thread: -Bilgi!! by P.Merkezi on Monday, December 28, 2009 - 6:11 pm. (1 message)

Next thread: Add support for sysconf(3) _SC_NPROCESSORS_CONF / _SC_NPROCESSORS_ONLN by Brad on Monday, December 28, 2009 - 7:45 pm. (3 messages)