Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 24 Aug 2021 18:29:19 GMT
From:      Gordon Tetlow <gordon@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 060510ba8bfb - releng/13.0 - Fix libfetch out of bounds read.
Message-ID:  <202108241829.17OITJmP023948@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch releng/13.0 has been updated by gordon:

URL: https://cgit.FreeBSD.org/src/commit/?id=060510ba8bfba7a59908fb5aa99aa8d17d6882c8

commit 060510ba8bfba7a59908fb5aa99aa8d17d6882c8
Author:     Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2021-08-24 18:00:47 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2021-08-24 18:00:47 +0000

    Fix libfetch out of bounds read.
    
    Approved by:    so
    Security:       SA-21:15.libfetch
    Security:       CVE-2021-36159
---
 lib/libfetch/ftp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/libfetch/ftp.c b/lib/libfetch/ftp.c
index 9a546f3fecad..dfde6edce734 100644
--- a/lib/libfetch/ftp.c
+++ b/lib/libfetch/ftp.c
@@ -704,8 +704,11 @@ ftp_transfer(conn_t *conn, const char *oper, const char *file,
 				goto ouch;
 			}
 			l = (e == FTP_PASSIVE_MODE ? 6 : 21);
-			for (i = 0; *p && i < l; i++, p++)
+			for (i = 0; *p && i < l; i++, p++) {
 				addr[i] = strtol(p, &p, 10);
+				if (*p == '\0' && i < l - 1)
+					break;
+			}
 			if (i < l) {
 				e = FTP_PROTOCOL_ERROR;
 				goto ouch;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108241829.17OITJmP023948>