Actions
Security #5026
closedftp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd input
Affected Versions:
Label:
CVE:
Git IDs:
008dd8bde59c405e0c9454508cd8a2adc6784559
746f0236f55f0af66cee8ebf9c4ffdd4cc054cc4
Severity:
MODERATE
Disclosure Date:
Description
We tend to execute
ptmp = FTPRealloc(line_state->db, line_state->db_len,
(line_state->db_len + state->input_len));
if (ptmp == NULL) {
FTPFree(line_state->db, line_state->db_len);
line_state->db = NULL;
line_state->db_len = 0;
return -1;
}
line_state->db = ptmp;
memcpy(line_state->db + line_state->db_len,
state->input, state->input_len);
line_state->db_len += state->input_len;
}
state->input += state->input_len;
state->input_len = 0;
indefinitely.
Actions