forks/tftp-hpa-google
1
0
Fork 0
forked from mirrors/tftp-hpa-google
Code Pull requests Releases 1 Activity

Avoid possible memory-smashing bug, and rewrite some really stupid

Browse source 
initialization code.
This commit is contained in:
hpa 2001-08-10 18:47:11 +00:00
parent 5b0cb11445
commit 11c90592b5
1 changed files with 17 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

36
tftpd/tftpd.c
View file

@ -122,7 +122,7 @@ off_t tsize;
int tsize_ok; int tsize_ok;
int ndirs; int ndirs;
char **dirs; const char **dirs;
int secure = 0; int secure = 0;
int cancreate = 0; int cancreate = 0;
@ -201,7 +201,7 @@ main(int argc, char **argv)
struct options *opt; struct options *opt;
struct sockaddr_in myaddr; struct sockaddr_in myaddr;
struct sockaddr_in bindaddr; struct sockaddr_in bindaddr;
int n = 0; int n;
int on = 1; int on = 1;
int fd = 0; int fd = 0;
int listen = 0; /* Standalone (listen) mode */ int listen = 0; /* Standalone (listen) mode */
@ -267,20 +267,12 @@ main(int argc, char **argv)
usage(); usage();
break; break;
} }
for (; optind != argc; optind++) { dirs = xmalloc((argc-optind+1)*sizeof(char *));
if (dirs) for ( ndirs = 0 ; optind != argc ; optind++ )
dirs = realloc(dirs, (ndirs+2) * sizeof (char *)); dirs[ndirs++] = argv[optind];
else
dirs = calloc(ndirs+2, sizeof(char *)); dirs[ndirs] = NULL;
if (dirs == NULL) {
syslog(LOG_ERR, "malloc: %m");
exit(EX_OSERR);
}
dirs[n++] = argv[optind];
dirs[n] = NULL;
ndirs++;
}
if (secure) { if (secure) {
if (ndirs == 0) { if (ndirs == 0) {
@ -817,8 +809,10 @@ int
validate_access(char *filename, int mode, struct formats *pf) validate_access(char *filename, int mode, struct formats *pf)
{ {
struct stat stbuf; struct stat stbuf;
int i, len;
int fd, wmode; int fd, wmode;
char *cp, **dirp; char *cp;
const char **dirp;
tsize_ok = 0; tsize_ok = 0;
@ -829,9 +823,13 @@ validate_access(char *filename, int mode, struct formats *pf)
* prevent tricksters from getting around the directory * prevent tricksters from getting around the directory
* restrictions * restrictions
*/ */
for (cp = filename + 1; *cp; cp++) len = strlen(filename);
if(*cp == '.' && strncmp(cp-1, "/../", 4) == 0) for ( i = 1 ; i < len-3 ; i++ ) {
cp = filename + i;
if ( *cp == '.' && memcmp(cp-1, "/../", 4) == 0)
return(EACCESS); return(EACCESS);
}
for (dirp = dirs; *dirp; dirp++) for (dirp = dirs; *dirp; dirp++)
if (strncmp(filename, *dirp, strlen(*dirp)) == 0) if (strncmp(filename, *dirp, strlen(*dirp)) == 0)
break; break;