Deny the SIZE command on large files when in ASCII mode.
This eliminates an opportunity for DoS attack. Pointed out by: maxim Inspired by: lukemftpd, OpenBSD MFC after: 2 weeks
This commit is contained in:
parent
5e33115f05
commit
781cfb9348
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=101034
@ -1068,6 +1068,8 @@ check_login_ro
|
||||
|
||||
#define MAXGLOBARGS 1000
|
||||
|
||||
#define MAXASIZE 10240 /* Deny ASCII SIZE on files larger than that */
|
||||
|
||||
struct tab {
|
||||
char *name;
|
||||
short token;
|
||||
@ -1589,6 +1591,10 @@ sizecmd(char *filename)
|
||||
reply(550, "%s: not a plain file.", filename);
|
||||
(void) fclose(fin);
|
||||
return;
|
||||
} else if (stbuf.st_size > MAXASIZE) {
|
||||
reply(550, "%s: too large for type A SIZE.", filename);
|
||||
(void) fclose(fin);
|
||||
return;
|
||||
}
|
||||
|
||||
count = 0;
|
||||
|
Loading…
Reference in New Issue
Block a user