1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
Gentoo patch from http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/net-ftp/gftp/files/gftp-2.0.18-188252.patch?rev=1.1
addresses: CVE-2007-3961, CVE-2007-3962
diff --exclude-from=/home/dang/.scripts/diffrc -up -bruN gftp-2.0.18.orig/lib/fsplib/fsplib.c gftp-2.0.18/lib/fsplib/fsplib.c
--- gftp-2.0.18.orig/lib/fsplib/fsplib.c 2005-01-18 21:03:45.000000000 -0500
+++ gftp-2.0.18/lib/fsplib/fsplib.c 2007-09-21 16:03:01.000000000 -0400
@@ -612,7 +612,7 @@ int fsp_readdir_r(FSP_DIR *dir,struct di
entry->d_reclen = fentry.reclen;
strncpy(entry->d_name,fentry.name,MAXNAMLEN);
- if (fentry.namlen > MAXNAMLEN)
+ if (fentry.namlen >= MAXNAMLEN)
{
entry->d_name[MAXNAMLEN + 1 ] = '\0';
#ifdef HAVE_NAMLEN
@@ -680,9 +680,19 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_
/* skip file date and file size */
dir->dirpos += 9;
/* read file name */
- entry->name[255 + 1] = '\0';
+ entry->name[255] = '\0';
strncpy(entry->name,(char *)( dir->data + dir->dirpos ),MAXNAMLEN);
+ /* check for ASCIIZ encoded filename */
+ if (memchr(dir->data + dir->dirpos,0,dir->datasize - dir->dirpos) != NULL)
+ {
namelen = strlen( (char *) dir->data+dir->dirpos);
+ }
+ else
+ {
+ /* \0 terminator not found at end of filename */
+ *result = NULL;
+ return 0;
+ }
/* skip over file name */
dir->dirpos += namelen +1;
@@ -709,12 +719,12 @@ int fsp_readdir_native(FSP_DIR *dir,FSP_
struct dirent * fsp_readdir(FSP_DIR *dirp)
{
- static struct dirent entry;
+ static dirent_workaround entry;
struct dirent *result;
if (dirp == NULL) return NULL;
- if ( fsp_readdir_r(dirp,&entry,&result) )
+ if ( fsp_readdir_r(dirp,&entry.dirent,&result) )
return NULL;
else
return result;
diff --exclude-from=/home/dang/.scripts/diffrc -up -bruN gftp-2.0.18.orig/lib/fsplib/fsplib.h gftp-2.0.18/lib/fsplib/fsplib.h
--- gftp-2.0.18.orig/lib/fsplib/fsplib.h 2005-01-18 21:04:02.000000000 -0500
+++ gftp-2.0.18/lib/fsplib/fsplib.h 2007-09-21 15:56:37.000000000 -0400
@@ -1,6 +1,8 @@
#ifndef _FSPLIB_H
#define _FSPLIB_H 1
#include <time.h>
+#include <stddef.h>
+
/* The FSP v2 protocol support library - public interface */
/*
@@ -138,6 +140,12 @@ typedef struct FSP_FILE {
unsigned int pos; /* position of next packet */
} FSP_FILE;
+
+typedef union dirent_workaround {
+ struct dirent dirent;
+ char fill[offsetof (struct dirent, d_name) + MAXNAMLEN + 1];
+} dirent_workaround;
+
/* function prototypes */
/* session management */
|
