rpms/ftp
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: #1624949 - netkit ftp client buffer overflow in makeargv()

Browse Source
This commit is contained in:
Michal Ruprich 2018-12-18 19:35:29 +01:00
parent 5f9f7af894
commit 9ab20310d9
2 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ftp.spec
View File

@ -1,7 +1,7 @@
Summary: The standard UNIX FTP (File Transfer Protocol) client
Name: ftp
Version: 0.17
Release: 78%{?dist}
Release: 79%{?dist}
License: BSD with advertising
Group: Applications/Internet
Source0: ftp://ftp.linux.org.uk/pub/linux/Networking/netkit/netkit-ftp-%{version}.tar.gz
@ -40,6 +40,7 @@ Patch31: netkit-ftp-0.17-commands-leaks.patch
Patch32: netkit-ftp-0.17-lsn-timeout.patch
Patch33: netkit-ftp-0.17-getlogin.patch
Patch34: netkit-ftp-0.17-token.patch
Patch35: netkit-ftp-0.17-linelen-segfault.patch
BuildRequires: glibc-devel, readline-devel, ncurses-devel
BuildRequires: perl-interpreter, gcc
@ -88,6 +89,7 @@ file transfers.
%patch32 -p1 -b .lsn-timeout
%patch33 -p1 -b .getlogin
%patch34 -p1 -b .token
%patch35 -p1 -b .linelen-segfault
%build
sh configure --with-c-compiler=gcc --enable-ipv6
@ -117,6 +119,9 @@ make INSTALLROOT=${RPM_BUILD_ROOT} install
%{_mandir}/man5/netrc.*
%changelog
* Tue Dec 18 2018 Michal Ruprich <mruprich@redhat.com> - 0.17-79
- Resolves: #1624949 - netkit ftp client buffer overflow in makeargv()
* Mon Jul 23 2018 Michal Ruprich <mruprich@redhat.com> - 0.17-78
- Resolves: #1604015 - ftp: FTBFS in Fedora rawhide

23
netkit-ftp-0.17-linelen-segfault.patch Normal file
View File

@ -0,0 +1,23 @@
diff -up netkit-ftp-0.17/ftp/ftp.c.orig netkit-ftp-0.17/ftp/ftp.c
diff -up netkit-ftp-0.17/ftp/ftp_var.h.orig netkit-ftp-0.17/ftp/ftp_var.h
diff -up netkit-ftp-0.17/ftp/main.c.orig netkit-ftp-0.17/ftp/main.c
--- netkit-ftp-0.17/ftp/main.c.orig 2018-09-03 16:49:16.459000000 +0200
+++ netkit-ftp-0.17/ftp/main.c 2018-09-03 17:00:14.853452345 +0200
@@ -399,7 +399,7 @@ int slrflag;
char **
makeargv(int *pargc, char **parg)
{
- static char *rargv[20];
+ static char *rargv[LINELEN];
int rargc = 0;
char **argp;
@@ -407,7 +407,7 @@ makeargv(int *pargc, char **parg)
stringbase = line; /* scan from first of buffer */
argbase = argbuf; /* store from first of buffer */
slrflag = 0;
- while ((*argp++ = slurpstring())!=NULL)
+ while ((rargc < LINELEN) && (*argp++ = slurpstring())!=NULL)
rargc++;
*pargc = rargc;