Security #5026: ftp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd input - Suricata - Open Information Security Foundation

Actions

Copy link

Security #5026

closed

ftp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd input

Added by Shivani Bhardwaj over 2 years ago. Updated over 1 year ago.

Status:

Closed

Priority:

Urgent

Assignee:

Jason Ish

Target version:

6.0.5

Affected Versions:

Label:

CVE:

Git IDs:

008dd8bde59c405e0c9454508cd8a2adc6784559
746f0236f55f0af66cee8ebf9c4ffdd4cc054cc4

Severity:

MODERATE

Disclosure Date:

Description

We tend to execute


           ptmp = FTPRealloc(line_state->db, line_state->db_len,
                             (line_state->db_len + state->input_len));
            if (ptmp == NULL) {
                FTPFree(line_state->db, line_state->db_len);
                line_state->db = NULL;
                line_state->db_len = 0; 
                return -1;
            }
            line_state->db = ptmp;

            memcpy(line_state->db + line_state->db_len,
                   state->input, state->input_len);
            line_state->db_len += state->input_len;
        }    
        state->input += state->input_len;
        state->input_len = 0;

indefinitely.

Related issues 1 (0 open — 1 closed)