summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorErik Auerswald <auerswal@unix-ag.uni-kl.de>2022-10-01 18:22:00 +0200
committerErik Auerswald <auerswal@unix-ag.uni-kl.de>2022-10-01 18:25:34 +0200
commitef17ae467e8893f1e3dade95212e91fc411d2714 (patch)
treeabfb14a65c3df593d31cd6aeb5b900bd5e17a790
parent5019909b842c849d2c5ba87c85f68b06cda3ef02 (diff)
downloadinetutils-ef17ae467e8893f1e3dade95212e91fc411d2714.tar.gz
ftp: Avoid NULL pointer dereference with nmap
This fixes the problem reported by AiDai in <https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00004.html>. * NEWS: Mention fix. * ftp/cmds.c (setnmap): Accept both space and tab characters between command arguments.
-rw-r--r--NEWS3
-rw-r--r--ftp/cmds.c16
2 files changed, 13 insertions, 6 deletions
diff --git a/NEWS b/NEWS
index c0cf49b..a0d8c82 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,9 @@ out-of-bounds buffer access. Reported by AiDai in
*** Avoid crash caused by heap buffer overflow. Reported by ZFeiXQ in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00016.html>.
+*** Avoid crash caused by NULL pointer dereference. Reported by AiDai in
+<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00004.html>.
+
** telnetd
*** Avoid crash on 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL). CVE-2022-39028
diff --git a/ftp/cmds.c b/ftp/cmds.c
index f958f19..60e9eec 100644
--- a/ftp/cmds.c
+++ b/ftp/cmds.c
@@ -2292,21 +2292,25 @@ setnmap (int argc, char **argv)
}
mapflag = 1;
code = 1;
- cp = strchr (altarg, ' ');
+ cp = altarg;
+ while (*cp && !isblank (*cp))
+ cp++;
if (proxy)
{
- while (*++cp == ' ')
- continue;
+ while (*cp && isblank(*cp))
+ cp++;
altarg = cp;
- cp = strchr (altarg, ' ');
+ while (*cp && !isblank (*cp))
+ cp++;
}
*cp = '\0';
free (mapin);
mapin = strdup (altarg);
- while (*++cp == ' ')
- continue;
+ do
+ cp++;
+ while (*cp && isblank(*cp));
free (mapout);
mapout = strdup (cp);
}