diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2017-09-25 00:35:22 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-02 07:50:17 +0200 |
| commit | 5ff2c5ff25750aba1a8f64fbcad8e5b891512584 (patch) | |
| tree | 25b6f46b52aa7271bb3255aa0907e968b024f0ce /tests/data/test1152 | |
| parent | 440dbcb06e8dedba1551e32046a9415adb82eb0b (diff) | |
FTP: zero terminate the entry path even on bad input
... a single double quote could leave the entry path buffer without a zero
terminating byte. CVE-2017-1000254
Test 1152 added to verify.
Reported-by: Max Dymond
Bug: https://curl.haxx.se/docs/adv_20171004.html
Diffstat (limited to 'tests/data/test1152')
| -rw-r--r-- | tests/data/test1152 | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/tests/data/test1152 b/tests/data/test1152 new file mode 100644 index 000000000..aa8c0a7e4 --- /dev/null +++ b/tests/data/test1152 @@ -0,0 +1,61 @@ +<testcase> +<info> +<keywords> +FTP +PASV +LIST +</keywords> +</info> +# +# Server-side +<reply> +<servercmd> +REPLY PWD 257 "just one +</servercmd> + +# When doing LIST, we get the default list output hard-coded in the test +# FTP server +<data mode="text"> +total 20 +drwxr-xr-x 8 98 98 512 Oct 22 13:06 . +drwxr-xr-x 8 98 98 512 Oct 22 13:06 .. +drwxr-xr-x 2 98 98 512 May 2 1996 curl-releases +-r--r--r-- 1 0 1 35 Jul 16 1996 README +lrwxrwxrwx 1 0 1 7 Dec 9 1999 bin -> usr/bin +dr-xr-xr-x 2 0 1 512 Oct 1 1997 dev +drwxrwxrwx 2 98 98 512 May 29 16:04 download.html +dr-xr-xr-x 2 0 1 512 Nov 30 1995 etc +drwxrwxrwx 2 98 1 512 Oct 30 14:33 pub +dr-xr-xr-x 5 0 1 512 Oct 1 1997 usr +</data> +</reply> + +# +# Client-side +<client> +<server> +ftp +</server> + <name> +FTP with uneven quote in PWD response + </name> + <command> +ftp://%HOSTIP:%FTPPORT/test-1152/ +</command> +</client> + +# +# Verify data after the test has been "shot" +<verify> +<protocol> +USER anonymous
+PASS ftp@example.com
+PWD
+CWD test-1152
+EPSV
+TYPE A
+LIST
+QUIT
+</protocol> +</verify> +</testcase> |