Actions
Security #5025
closedftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input
Affected Versions:
Label:
CVE:
Git IDs:
9f10e338108bc26ec53af6d5ac53126d06f723e5
b2da5e86ea9315ad876e50bb95dcb8be70f959b5
Severity:
MODERATE
Disclosure Date:
Description
We tend to execute
ptmp = FTPRealloc(line_state->db, line_state->db_len,
(line_state->db_len + state->input_len));
if (ptmp == NULL) {
FTPFree(line_state->db, line_state->db_len);
line_state->db = NULL;
line_state->db_len = 0;
return -1;
}
line_state->db = ptmp;
memcpy(line_state->db + line_state->db_len,
state->input, state->input_len);
line_state->db_len += state->input_len;
}
state->input += state->input_len;
state->input_len = 0;
indefinitely.
Actions