>Number:         16642
>Category:       bin
>Synopsis:       ftp/cmds.c msl() function defines a bad mode for recvrequest()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 03 13:42:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Steve McClellan
>Release:        NetBSD: cmds.c,v 1.87.2.1 2000/10/18 01:32:42 tv Exp
>Organization:
RadiSys
>Environment:
OS-9 ARMv4
>Description:
In mls() of cmds.c, only a single byte is allocated for the mode. This mode is later passed to fopen() in recvrequest(). fopen() expects a null terminated string, not a single character.
>How-To-Repeat:
3511:ftp -v ftp://stevem:stevem@cypher/
Connected to cypher.dm1.radisys.com.
220-
220 cypher.microware.com FTP server (NetBSD-ftpd 20010329) ready.
331 Password required for stevem.
230-
    NetBSD 1.5.1 (GENERIC) #56: Mon Jul  2 15:54:23 CEST 2001

    Welcome to NetBSD!

230 User stevem logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
200 Type set to I.
ftp>  mdir TEMP3 tmp
output to local-file: tmp [anpqy?]? a
Prompting off for duration of output to local-file:.
229 Entering Extended Passive Mode (|||65341|)
150 Opening ASCII mode data connection for '/bin/ls'.
ftp: local: tmp: 000:203
426 Transfer aborted. Data connection closed.
226 Abort successful
ftp> quit
221-
    Data traffic for this session was 0 bytes in 0 files.
    Total traffic for this session was 700 bytes in 1 transfer.
221 Thank you for using the FTP service on cypher.microware.com.
>Fix:
In ftp's cmds.c's mls(), I changed:
    char mode[1], *dest, *odest;
to:
    char mode[2], *dest, *odest;
    *(mode+1) = '\0';
>Release-Note:
>Audit-Trail:
>Unformatted: