Date: Sun, 15 Jul 2001 08:59:28 -0700 (PDT) From: SASAKI Taroh <taroh@taroh.org> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/28990: ftp(1) has stack overflow when "mget *", etc. Message-ID: <200107151559.f6FFxS383951@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 28990 >Category: bin >Synopsis: ftp(1) has stack overflow when "mget *", etc. >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Jul 15 09:00:01 PDT 2001 >Closed-Date: >Last-Modified: >Originator: SASAKI Taroh >Release: 4.3-20010713-STABLE >Organization: kanagawa university >Environment: FreeBSD ns1.taroh.org 4.3-20010713-STABLE FreeBSD 4.3-20010713-STABLE #0: Sat Jul 14 15:46:29 JST 2001 root@ns1.taroh.org:/local.ground/usr_src/sys/compile/ns1 i386 >Description: my stack protector (http://www.trl.ibm.com/projects/security/ssp/) detected illegal stack access in ftp(1) client in util.c in /usr/src/usr.bin/ftp/util.c . this appears when the client issures NLST command to the remote. >How-To-Repeat: compile ftp(1) with stack protector and do "mget *" in any remote hosts. >Fix: *** usr/src/usr.bin/ftp/util.c Mon Jul 16 00:45:11 2001 --- usr/src/usr.bin/ftp/util.c.org Mon Jul 16 00:37:57 2001 *************** *** 371,377 **** hash = 0; if (doswitch) pswitch(!proxy); ! for (mode = "w", ++argv; *argv != NULL; argv++, mode = "a") recvrequest("NLST", temp, *argv, mode, 0, 0); if ((code / 100) != COMPLETE) { if (errbuf != NULL) --- 371,377 ---- hash = 0; if (doswitch) pswitch(!proxy); ! for (mode = "w"; *++argv != NULL; mode = "a") recvrequest("NLST", temp, *argv, mode, 0, 0); if ((code / 100) != COMPLETE) { if (errbuf != NULL) >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200107151559.f6FFxS383951>