322db3efc0
Daniel Stenberg
2026-03-21
Subject
ftp: make the MDTM date parser stricter (again)
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/ftp.c+13 -10
| @@ -2489,24 +2489,27 @@ static CURLcode ftp_state_port_resp(struct Curl_easy *data, | |
| return result; | |
| } | |
| - | static int twodigit(const char *p) |
| + | /* return TRUE on error, FALSE on success */ |
| + | static bool twodigit(const char *p, int *val) |
| { | |
| - | return ((p[0] - '0') * 10) + (p[1] - '0'); |
| + | if(!ISDIGIT(p[0]) || !ISDIGIT(p[1])) |
| + | return TRUE; |
| + | /* curlx_hexval() works fine here since we make sure it is decimal above */ |
| + | *val = (curlx_hexval(p[0]) * 10) + curlx_hexval(p[1]); |
| + | return FALSE; |
| } | |
| static bool ftp_213_date(const char *p, int *year, int *month, int *day, | |
| int *hour, int *minute, int *second) | |
| { | |
| - | size_t len = strlen(p); |
| - | if(len < 14) |
| + | int century; |
| + | if((strlen(p) < 14) || twodigit(&p[0], ¢ury) || twodigit(&p[2], year) || |
| + | twodigit(&p[4], month) || twodigit(&p[6], day) || |
| + | twodigit(&p[8], hour) || twodigit(&p[10], minute) || |
| + | twodigit(&p[12], second)) |
| return FALSE; | |
| - | *year = (twodigit(&p[0]) * 100) + twodigit(&p[2]); |
| - | *month = twodigit(&p[4]); |
| - | *day = twodigit(&p[6]); |
| - | *hour = twodigit(&p[8]); |
| - | *minute = twodigit(&p[10]); |
| - | *second = twodigit(&p[12]); |
| + | *year += century * 100; |
| if((*month > 12) || (*day > 31) || (*hour > 23) || (*minute > 59) || | |
| (*second > 60)) | |
| return FALSE; | |
tests/data/Makefile.am+1 -1
| @@ -226,7 +226,7 @@ test1666 test1667 \ | |
| \ | |
| test1670 test1671 \ | |
| \ | |
| - | test1680 test1681 test1682 test1683 \ |
| + | test1680 test1681 test1682 test1683 test1684 \ |
| \ | |
| test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \ | |
| test1708 test1709 test1710 test1711 test1712 test1713 \ | |
tests/data/test1684+46 -0
| @@ -0,0 +1,46 @@ | |
| + | <?xml version="1.0" encoding="US-ASCII"?> |
| + | <testcase> |
| + | <info> |
| + | <keywords> |
| + | FTP |
| + | MDTM |
| + | </keywords> |
| + | </info> |
| + | |
| + | <reply> |
| + | <data> |
| + | a joke |
| + | </data> |
| + | <mdtm> |
| + | 213 2003040a102659 |
| + | </mdtm> |
| + | </reply> |
| + | |
| + | # Client-side |
| + | <client> |
| + | <server> |
| + | ftp |
| + | </server> |
| + | <name> |
| + | FTP with malformed MDTM response |
| + | </name> |
| + | <command> |
| + | ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -z "apr 1 2025 08:00:00" |
| + | </command> |
| + | </client> |
| + | |
| + | # Verify data after the test has been "shot" |
| + | <verify> |
| + | <protocol crlf="yes"> |
| + | USER anonymous |
| + | PASS [email protected] |
| + | PWD |
| + | MDTM %TESTNUMBER |
| + | EPSV |
| + | TYPE I |
| + | SIZE %TESTNUMBER |
| + | RETR %TESTNUMBER |
| + | QUIT |
| + | </protocol> |
| + | </verify> |
| + | </testcase> |