From 5ff2c5ff25750aba1a8f64fbcad8e5b891512584 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 25 Sep 2017 00:35:22 +0200 Subject: FTP: zero terminate the entry path even on bad input ... a single double quote could leave the entry path buffer without a zero terminating byte. CVE-2017-1000254 Test 1152 added to verify. Reported-by: Max Dymond Bug: https://curl.haxx.se/docs/adv_20171004.html --- tests/data/test1152 | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 tests/data/test1152 (limited to 'tests/data/test1152') diff --git a/tests/data/test1152 b/tests/data/test1152 new file mode 100644 index 000000000..aa8c0a7e4 --- /dev/null +++ b/tests/data/test1152 @@ -0,0 +1,61 @@ + + + +FTP +PASV +LIST + + +# +# Server-side + + +REPLY PWD 257 "just one + + +# When doing LIST, we get the default list output hard-coded in the test +# FTP server + +total 20 +drwxr-xr-x 8 98 98 512 Oct 22 13:06 . +drwxr-xr-x 8 98 98 512 Oct 22 13:06 .. +drwxr-xr-x 2 98 98 512 May 2 1996 curl-releases +-r--r--r-- 1 0 1 35 Jul 16 1996 README +lrwxrwxrwx 1 0 1 7 Dec 9 1999 bin -> usr/bin +dr-xr-xr-x 2 0 1 512 Oct 1 1997 dev +drwxrwxrwx 2 98 98 512 May 29 16:04 download.html +dr-xr-xr-x 2 0 1 512 Nov 30 1995 etc +drwxrwxrwx 2 98 1 512 Oct 30 14:33 pub +dr-xr-xr-x 5 0 1 512 Oct 1 1997 usr + + + +# +# Client-side + + +ftp + + +FTP with uneven quote in PWD response + + +ftp://%HOSTIP:%FTPPORT/test-1152/ + + + +# +# Verify data after the test has been "shot" + + +USER anonymous +PASS ftp@example.com +PWD +CWD test-1152 +EPSV +TYPE A +LIST +QUIT + + + -- cgit v1.2.3