diff options
| author | Erik Auerswald <auerswal@unix-ag.uni-kl.de> | 2022-10-01 18:22:00 +0200 |
|---|---|---|
| committer | Erik Auerswald <auerswal@unix-ag.uni-kl.de> | 2022-10-01 18:25:34 +0200 |
| commit | ef17ae467e8893f1e3dade95212e91fc411d2714 (patch) | |
| tree | abfb14a65c3df593d31cd6aeb5b900bd5e17a790 | |
| parent | 5019909b842c849d2c5ba87c85f68b06cda3ef02 (diff) | |
| download | inetutils-ef17ae467e8893f1e3dade95212e91fc411d2714.tar.gz | |
ftp: Avoid NULL pointer dereference with nmap
This fixes the problem reported by AiDai in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00004.html>.
* NEWS: Mention fix.
* ftp/cmds.c (setnmap): Accept both space and tab characters
between command arguments.
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ftp/cmds.c | 16 |
2 files changed, 13 insertions, 6 deletions
@@ -11,6 +11,9 @@ out-of-bounds buffer access. Reported by AiDai in *** Avoid crash caused by heap buffer overflow. Reported by ZFeiXQ in <https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00016.html>. +*** Avoid crash caused by NULL pointer dereference. Reported by AiDai in +<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00004.html>. + ** telnetd *** Avoid crash on 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL). CVE-2022-39028 @@ -2292,21 +2292,25 @@ setnmap (int argc, char **argv) } mapflag = 1; code = 1; - cp = strchr (altarg, ' '); + cp = altarg; + while (*cp && !isblank (*cp)) + cp++; if (proxy) { - while (*++cp == ' ') - continue; + while (*cp && isblank(*cp)) + cp++; altarg = cp; - cp = strchr (altarg, ' '); + while (*cp && !isblank (*cp)) + cp++; } *cp = '\0'; free (mapin); mapin = strdup (altarg); - while (*++cp == ' ') - continue; + do + cp++; + while (*cp && isblank(*cp)); free (mapout); mapout = strdup (cp); } |
