Bug 28990

Summary: ftp(1) has stack overflow when "mget *", etc.
Product: Base System Reporter: SASAKI Taroh <taroh>
Component: binAssignee: Mike Heffner <mikeh>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description SASAKI Taroh 2001-07-15 17:00:01 UTC 
my stack protector (http://www.trl.ibm.com/projects/security/ssp/) detected
illegal stack access in ftp(1) client in util.c in /usr/src/usr.bin/ftp/util.c .
this appears when the client issures NLST command to the remote.

How-To-Repeat: compile ftp(1) with stack protector and do "mget *" in any remote hosts.
Comment 1 jedgar 2001-07-15 18:23:58 UTC 
On Sun, Jul 15, 2001 at 08:59:28AM -0700, SASAKI Taroh wrote:
> 
> >Fix:
> *** usr/src/usr.bin/ftp/util.c  Mon Jul 16 00:45:11 2001
> --- usr/src/usr.bin/ftp/util.c.org      Mon Jul 16 00:37:57 2001
> ***************
> *** 371,377 ****
>                   hash = 0;
>                   if (doswitch)
>                           pswitch(!proxy);
> !                 for (mode = "w", ++argv; *argv != NULL; argv++, mode = "a")


I don't seem to be able to locate this piece of code in util.c.
According to cvsweb, the 'fix' has been in the tree since rev 1.1.

>                           recvrequest("NLST", temp, *argv, mode, 0, 0);
>                 if ((code / 100) != COMPLETE) {
>                         if (errbuf != NULL)
> --- 371,377 ----
>                   hash = 0;
>                   if (doswitch)
>                           pswitch(!proxy);
> !                 for (mode = "w"; *++argv != NULL; mode = "a")
>                           recvrequest("NLST", temp, *argv, mode, 0, 0);
>                 if ((code / 100) != COMPLETE) {
>                         if (errbuf != NULL)
> 


-- 
Chris D. Faulhaber - jedgar@fxp.org - jedgar@FreeBSD.org
--------------------------------------------------------
FreeBSD: The Power To Serve   -   http://www.FreeBSD.org
Comment 2 SASAKI Taroh 2001-07-15 19:34:40 UTC 
hi,

At Sun, 15 Jul 2001 13:23:58 -0400,
Chris Faulhaber <jedgar@fxp.org> wrote:

> > !                 for (mode = "w", ++argv; *argv != NULL; argv++, mode = "a")
(snip)
> > !                 for (mode = "w"; *++argv != NULL; mode = "a")

> I don't seem to be able to locate this piece of code in util.c.
> According to cvsweb, the 'fix' has been in the tree since rev 1.1.

	sorry, my mistake.
	that's because the diff arguments are in reverse order
	(diff NEW OLD):

> > *** usr/src/usr.bin/ftp/util.c  Mon Jul 16 00:45:11 2001
> > --- usr/src/usr.bin/ftp/util.c.org      Mon Jul 16 00:37:57 2001

thanks,

* Please don't attach any application dependent (e.g. MS-Excel or Word)
  file. I'll NEVER open it for the sake of protecting the network.

--- SASAKI, Taroh         | When you go on this road, never be anxious.|
    mailto:taroh@taroh.org|               If you fear, there's no road.|
    http://www.taroh.org/ | ???         If you step, that'll be a road.|
    phone://81/908/50/76728  %   Go, don't be hesitate.  You will know.|
    icq:19785633          |  **********  ***      --- Ikkyu, the Bonze |
    address:jp/221/0005/4/541/1/203A  **** ----------------------------+
    global:/wgs84/n35/30/06.9/e139/38/14.6/h29
    pgpfingerprint:4C/6A/E6/0E/D5/A1/DA/AC/54/8F/94/E9/E3/F2/9C/08
Comment 3 mheffner 2001-07-15 21:20:23 UTC 
On 15-Jul-2001 SASAKI Taroh wrote:
| 
|>Fix:
| *** usr/src/usr.bin/ftp/util.c  Mon Jul 16 00:45:11 2001
| --- usr/src/usr.bin/ftp/util.c.org      Mon Jul 16 00:37:57 2001
| ***************
| *** 371,377 ****
|                   hash = 0;
|                   if (doswitch)
|                           pswitch(!proxy);
| !                 for (mode = "w", ++argv; *argv != NULL; argv++, mode = "a")
|                           recvrequest("NLST", temp, *argv, mode, 0, 0);
|                 if ((code / 100) != COMPLETE) {
|                         if (errbuf != NULL)
| --- 371,377 ----
|                   hash = 0;
|                   if (doswitch)
|                           pswitch(!proxy);
| !                 for (mode = "w"; *++argv != NULL; mode = "a")
|                           recvrequest("NLST", temp, *argv, mode, 0, 0);
|                 if ((code / 100) != COMPLETE) {
|                         if (errbuf != NULL)

Now that I look at this more, this change is nil, there is no change in
behavior. What exactly is the 'illegal stack access' that your program is
detecting and where is it occuring?

Mike

-- 
  Mike Heffner         <mheffner@[acm.]vt.edu>
  Fredericksburg, VA       <mikeh@FreeBSD.org>
Comment 4 Mike Heffner freebsd_committer freebsd_triage 2001-07-20 03:28:28 UTC 
State Changed
From-To: open->feedback

Waiting for reply from originator.
Comment 5 Mike Heffner freebsd_committer freebsd_triage 2001-07-20 03:28:28 UTC 
Responsible Changed
From-To: freebsd-bugs->mikeh

I'll take this.
Comment 6 Mike Heffner freebsd_committer freebsd_triage 2001-10-02 06:35:47 UTC 
State Changed
From-To: feedback->closed

Feedback timeout.