[src/netbsd-1-5]: src/usr.bin/ftp Pull up revision 1.118 (requested by itojun):

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/b5074a38908d
branches:  netbsd-1-5
changeset: 493086:b5074a38908d
user:      he <he%NetBSD.org@localhost>
date:      Fri Apr 26 13:20:54 2002 +0000

description:
Pull up revision 1.118 (requested by itojun):
  Avoid buffer overrun on PASV response from a malicious server.

diffstat:

 usr.bin/ftp/ftp.c |  11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

diffs (32 lines):

diff -r 0aa1d9d6162a -r b5074a38908d usr.bin/ftp/ftp.c
--- a/usr.bin/ftp/ftp.c Fri Apr 26 13:17:42 2002 +0000
+++ b/usr.bin/ftp/ftp.c Fri Apr 26 13:20:54 2002 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ftp.c,v 1.100.2.1 2000/10/18 01:32:43 tv Exp $ */
+/*     $NetBSD: ftp.c,v 1.100.2.2 2002/04/26 13:20:54 he Exp $ */
 
 /*-
  * Copyright (c) 1996-2000 The NetBSD Foundation, Inc.
@@ -103,7 +103,7 @@
 #if 0
 static char sccsid[] = "@(#)ftp.c      8.6 (Berkeley) 10/27/94";
 #else
-__RCSID("$NetBSD: ftp.c,v 1.100.2.1 2000/10/18 01:32:43 tv Exp $");
+__RCSID("$NetBSD: ftp.c,v 1.100.2.2 2002/04/26 13:20:54 he Exp $");
 #endif
 #endif /* not lint */
 
@@ -573,9 +573,10 @@
                        if (dig > 4 && pflag == 1 && isdigit(c))
                                pflag = 2;
                        if (pflag == 2) {
-                               if (c != '\r' && c != ')')
-                                       *pt++ = c;
-                               else {
+                               if (c != '\r' && c != ')') {
+                                       if (pt < &pasv[sizeof(pasv) - 1])
+                                               *pt++ = c;
+                               } else {
                                        *pt = '\0';
                                        pflag = 3;
                                }