Date: Tue, 24 Aug 2021 18:28:53 GMT From: Gordon Tetlow <gordon@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 4200a810ea2c - stable/11 - Fix libfetch out of bounds read. Message-ID: <202108241828.17OISrTN023655@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/11 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=4200a810ea2cea77cd8473565f1c12c585f76e09 commit 4200a810ea2cea77cd8473565f1c12c585f76e09 Author: Gordon Tetlow <gordon@FreeBSD.org> AuthorDate: 2021-08-24 17:59:01 +0000 Commit: Gordon Tetlow <gordon@FreeBSD.org> CommitDate: 2021-08-24 18:00:03 +0000 Fix libfetch out of bounds read. Approved by: so Security: SA-21:15.libfetch Security: CVE-2021-36159 (cherry picked from commit 3be62d49ae2b6f9050f39fe74210c88f35901fa5) --- lib/libfetch/ftp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/libfetch/ftp.c b/lib/libfetch/ftp.c index c034b5efa240..1755012fc99b 100644 --- a/lib/libfetch/ftp.c +++ b/lib/libfetch/ftp.c @@ -702,8 +702,11 @@ ftp_transfer(conn_t *conn, const char *oper, const char *file, goto ouch; } l = (e == FTP_PASSIVE_MODE ? 6 : 21); - for (i = 0; *p && i < l; i++, p++) + for (i = 0; *p && i < l; i++, p++) { addr[i] = strtol(p, &p, 10); + if (*p == '\0' && i < l - 1) + break; + } if (i < l) { e = FTP_PROTOCOL_ERROR; goto ouch;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108241828.17OISrTN023655>