Synopsis: one-byte overrun in replydirname() in ftpd NetBSD versions: 1.5 See also: 20001220-ftpd-1.4.3 Thanks to: Kristian Vlaardingerbroek <kris@obit.nl>, Jun-ichiro itojun Hagino <itojun@iijlab.net> Index: libexec/ftpd/cmds.c =================================================================== RCS file: /cvsroot/basesrc/libexec/ftpd/cmds.c,v retrieving revision 1.4.2.1 retrieving revision 1.4.2.2 diff -u -u -r1.4.2.1 -r1.4.2.2 --- libexec/ftpd/cmds.c 2000/07/13 01:06:35 1.4.2.1 +++ libexec/ftpd/cmds.c 2000/12/13 21:18:09 1.4.2.2 @@ -787,14 +787,20 @@ static void replydirname(const char *name, const char *message) { + char *p, *ep; char npath[MAXPATHLEN]; - int i; - for (i = 0; *name != '\0' && i < sizeof(npath) - 1; i++, name++) { - npath[i] = *name; - if (*name == '"') - npath[++i] = '"'; + p = npath; + ep = &npath[sizeof(npath) - 1]; + while (*name) { + if (*name == '"' && ep - p >= 2) { + *p++ = *name++; + *p++ = '"'; + } else if (ep - p >= 1) + *p++ = *name++; + else + break; } - npath[i] = '\0'; + *p = '\0'; reply(257, "\"%s\" %s", npath, message); }