From 29b251362e1839d7094993edbed8f9467069773f Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 25 Sep 2017 00:35:22 +0200 Subject: [PATCH] FTP: zero terminate the entry path even on bad input ... a single double quote could leave the entry path buffer without a zero terminating byte. CVE-2017-1000254 Test 1152 added to verify. Reported-by: Max Dymond Bug: https://curl.se/docs/adv_20171004.html --- lib/ftp.c | 7 ++++-- tests/data/Makefile.inc | 1 + tests/data/test1152 | 61 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 tests/data/test1152 diff --git a/lib/ftp.c b/lib/ftp.c index 4860509f3..54ba4057f 100644 --- a/lib/ftp.c +++ b/lib/ftp.c @@ -2777,10 +2777,11 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) if(ftpcode == 257) { char *ptr = &data->state.buffer[4]; /* start on the first letter */ const size_t buf_size = data->set.buffer_size; char *dir; char *store; + bool entry_extracted = FALSE; dir = malloc(nread + 1); if(!dir) return CURLE_OUT_OF_MEMORY; @@ -2808,20 +2809,22 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) *store = ptr[1]; ptr++; } else { /* end of path */ - *store = '\0'; /* zero terminate */ + entry_extracted = TRUE; break; /* get out of this loop */ } } else *store = *ptr; store++; ptr++; } - + *store = '\0'; /* zero terminate */ + } + if(entry_extracted) { /* If the path name does not look like an absolute path (i.e.: it does not start with a '/'), we probably need some server-dependent adjustments. For example, this is the case when connecting to an OS400 FTP server: this server supports two name syntaxes, the default one being incompatible with standard paths. In diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc index 1bfd75eca..268f5e29e 100644 --- a/tests/data/Makefile.inc +++ b/tests/data/Makefile.inc @@ -120,10 +120,11 @@ test1104 test1105 test1106 test1107 test1108 test1109 test1110 test1111 \ test1112 test1113 test1114 test1115 test1116 test1117 test1118 test1119 \ test1120 test1121 test1122 test1123 test1124 test1125 test1126 test1127 \ test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \ test1136 test1137 test1138 test1139 test1140 test1141 test1142 test1143 \ test1144 test1145 test1146 test1147 test1148 test1149 test1150 test1151 \ +test1152 \ \ test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ test1208 test1209 test1210 test1211 test1212 test1213 test1214 test1215 \ test1216 test1217 test1218 test1219 \ test1220 test1221 test1222 test1223 test1224 test1225 test1226 test1227 \ diff --git a/tests/data/test1152 b/tests/data/test1152 new file mode 100644 index 000000000..aa8c0a7e4 --- /dev/null +++ b/tests/data/test1152 @@ -0,0 +1,61 @@ + + + +FTP +PASV +LIST + + +# +# Server-side + + +REPLY PWD 257 "just one + + +# When doing LIST, we get the default list output hard-coded in the test +# FTP server + +total 20 +drwxr-xr-x 8 98 98 512 Oct 22 13:06 . +drwxr-xr-x 8 98 98 512 Oct 22 13:06 .. +drwxr-xr-x 2 98 98 512 May 2 1996 curl-releases +-r--r--r-- 1 0 1 35 Jul 16 1996 README +lrwxrwxrwx 1 0 1 7 Dec 9 1999 bin -> usr/bin +dr-xr-xr-x 2 0 1 512 Oct 1 1997 dev +drwxrwxrwx 2 98 98 512 May 29 16:04 download.html +dr-xr-xr-x 2 0 1 512 Nov 30 1995 etc +drwxrwxrwx 2 98 1 512 Oct 30 14:33 pub +dr-xr-xr-x 5 0 1 512 Oct 1 1997 usr + + + +# +# Client-side + + +ftp + + +FTP with uneven quote in PWD response + + +ftp://%HOSTIP:%FTPPORT/test-1152/ + + + +# +# Verify data after the test has been "shot" + + +USER anonymous +PASS ftp@example.com +PWD +CWD test-1152 +EPSV +TYPE A +LIST +QUIT + + + -- 2.14.1