aboutsummaryrefslogtreecommitdiff
path: root/tests/data/test1152
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2017-09-25 00:35:22 +0200
committerDaniel Stenberg <daniel@haxx.se>2017-10-02 07:50:17 +0200
commit5ff2c5ff25750aba1a8f64fbcad8e5b891512584 (patch)
tree25b6f46b52aa7271bb3255aa0907e968b024f0ce /tests/data/test1152
parent440dbcb06e8dedba1551e32046a9415adb82eb0b (diff)
FTP: zero terminate the entry path even on bad input
... a single double quote could leave the entry path buffer without a zero terminating byte. CVE-2017-1000254 Test 1152 added to verify. Reported-by: Max Dymond Bug: https://curl.haxx.se/docs/adv_20171004.html
Diffstat (limited to 'tests/data/test1152')
-rw-r--r--tests/data/test115261
1 files changed, 61 insertions, 0 deletions
diff --git a/tests/data/test1152 b/tests/data/test1152
new file mode 100644
index 000000000..aa8c0a7e4
--- /dev/null
+++ b/tests/data/test1152
@@ -0,0 +1,61 @@
+<testcase>
+<info>
+<keywords>
+FTP
+PASV
+LIST
+</keywords>
+</info>
+#
+# Server-side
+<reply>
+<servercmd>
+REPLY PWD 257 "just one
+</servercmd>
+
+# When doing LIST, we get the default list output hard-coded in the test
+# FTP server
+<data mode="text">
+total 20
+drwxr-xr-x 8 98 98 512 Oct 22 13:06 .
+drwxr-xr-x 8 98 98 512 Oct 22 13:06 ..
+drwxr-xr-x 2 98 98 512 May 2 1996 curl-releases
+-r--r--r-- 1 0 1 35 Jul 16 1996 README
+lrwxrwxrwx 1 0 1 7 Dec 9 1999 bin -> usr/bin
+dr-xr-xr-x 2 0 1 512 Oct 1 1997 dev
+drwxrwxrwx 2 98 98 512 May 29 16:04 download.html
+dr-xr-xr-x 2 0 1 512 Nov 30 1995 etc
+drwxrwxrwx 2 98 1 512 Oct 30 14:33 pub
+dr-xr-xr-x 5 0 1 512 Oct 1 1997 usr
+</data>
+</reply>
+
+#
+# Client-side
+<client>
+<server>
+ftp
+</server>
+ <name>
+FTP with uneven quote in PWD response
+ </name>
+ <command>
+ftp://%HOSTIP:%FTPPORT/test-1152/
+</command>
+</client>
+
+#
+# Verify data after the test has been "shot"
+<verify>
+<protocol>
+USER anonymous
+PASS ftp@example.com
+PWD
+CWD test-1152
+EPSV
+TYPE A
+LIST
+QUIT
+</protocol>
+</verify>
+</testcase>