Project

General

Profile

Actions

Bug #5283

closed

5.0.x: ftp: don't let first incomplete segment be over maximum length

Added by Jeff Lucovsky 8 months ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The first non-terminated ftp command segment is buffered with no size limit. This results in a subsequent segment causing an integer to enter a negative state which is then asserted on with a DEBUG_VALIDATE_BUG_ON. Make sure the first segment is subject to limits of subsequent segments.

Then result is non-debug-validate-bug-on builds is that the first logged segment can be up to 65k, but their should be no security related issue here as the right thing is already done for negative values.


Related issues 1 (0 open1 closed)

Copied from Bug #5281: ftp: don't let first incomplete segment be over maximum lengthClosedJason IshActions
Actions #1

Updated by Jeff Lucovsky 8 months ago

  • Copied from Bug #5281: ftp: don't let first incomplete segment be over maximum length added
Actions #2

Updated by Jason Ish 7 months ago

  • Assignee changed from Jeff Lucovsky to Jason Ish
Actions #3

Updated by Jason Ish 7 months ago

  • Status changed from Assigned to In Review
Actions #4

Updated by Jason Ish 7 months ago

  • Subject changed from ftp: don't let first incomplete segment be over maximum length to 5.0.x: ftp: don't let first incomplete segment be over maximum length
Actions #5

Updated by Victor Julien 7 months ago

  • Status changed from In Review to Closed
Actions #6

Updated by Victor Julien 7 months ago

  • Affected Versions 5.0.9 added
  • Affected Versions deleted (6.0.5)
Actions

Also available in: Atom PDF