The branch releng/13.0 has been updated by gordon:
URL:
https://cgit.FreeBSD.org/src/commit/?id=060510ba8bfba7a59908fb5aa99aa8d17d6882c8
commit 060510ba8bfba7a59908fb5aa99aa8d17d6882c8
Author: Gordon Tetlow <gor...@freebsd.org>
AuthorDate: 2021-08-24 18:00:47 +0000
Commit: Gordon Tetlow <gor...@freebsd.org>
CommitDate: 2021-08-24 18:00:47 +0000
Fix libfetch out of bounds read.
Approved by: so
Security: SA-21:15.libfetch
Security: CVE-2021-36159
---
lib/libfetch/ftp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/lib/libfetch/ftp.c b/lib/libfetch/ftp.c
index 9a546f3fecad..dfde6edce734 100644
--- a/lib/libfetch/ftp.c
+++ b/lib/libfetch/ftp.c
@@ -704,8 +704,11 @@ ftp_transfer(conn_t *conn, const char *oper, const char
*file,
goto ouch;
}
l = (e == FTP_PASSIVE_MODE ? 6 : 21);
- for (i = 0; *p && i < l; i++, p++)
+ for (i = 0; *p && i < l; i++, p++) {
addr[i] = strtol(p, &p, 10);
+ if (*p == '\0' && i < l - 1)
+ break;
+ }
if (i < l) {
e = FTP_PROTOCOL_ERROR;
goto ouch;
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"
