d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Deny the SIZE command on large files when in ASCII mode.

Browse Source 
This eliminates an opportunity for DoS attack.

Pointed out by:	maxim
Inspired by:	lukemftpd, OpenBSD
MFC after:	2 weeks
This commit is contained in:
Yaroslav Tykhiy 2002-07-31 10:55:31 +00:00
parent 5e33115f05
commit 781cfb9348
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=101034
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libexec/ftpd/ftpcmd.y
View File

@ -1068,6 +1068,8 @@ check_login_ro
#define MAXGLOBARGS 1000
#define MAXASIZE 10240 /* Deny ASCII SIZE on files larger than that */
struct tab {
char *name;
short token;
@ -1589,6 +1591,10 @@ sizecmd(char *filename)
reply(550, "%s: not a plain file.", filename);
(void) fclose(fin);
return;
} else if (stbuf.st_size > MAXASIZE) {
reply(550, "%s: too large for type A SIZE.", filename);
(void) fclose(fin);
return;
}
count = 0;