Bug 25853

Summary:	ftpd eats all memory
Product:	Base System	Reporter:	hawk <hawk>
Component:	misc	Assignee:	jlemon
Status:	Closed FIXED
Severity:	Affects Only Me
Priority:	Normal
Version:	4.2-STABLE
Hardware:	Any
OS:	Any

Description hawk 2001-03-16 13:40:01 UTC

[15:32]sat@/home/hawk$ ftp sat
Connected to komora.cii.net.ua.
220 sat.cii.net.ua FTP server (Version 6.00LS) ready.
Name (sat:hawk): ftp
331 Guest login ok, send your email address as password.
Password:
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*

After it ftpd eats all memory and swap space. At last it was killed by kernel

How-To-Repeat: On ftp do:
ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*

Comment 1 ru freebsd_committer

2001-03-16 13:44:59 UTC

On Fri, Mar 16, 2001 at 05:38:15AM -0800, hawk@cii.sumy.ua wrote:
> 
> After it ftpd eats all memory and swap space. At last it was killed by kernel
> 
> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
> 
This was demonstrated and fixes yesterday in CURRENT.


-- 
Ruslan Ermilov		Oracle Developer/DBA,
ru@sunbay.com		Sunbay Software AG,
ru@FreeBSD.org		FreeBSD committer,
+380.652.512.251	Simferopol, Ukraine

http://www.FreeBSD.org	The Power To Serve
http://www.oracle.com	Enabling The Information Age

Comment 2 ru freebsd_committer

2001-03-16 13:45:26 UTC

Responsible Changed
From-To: freebsd-bugs->jlemon

Bad guys listen our stories :-)

Comment 3 jlemon freebsd_committer

2001-06-15 22:34:35 UTC

State Changed
From-To: open->closed

Some limits were added to 4.3 to restrict the scope of this problem.