File tnftp-cve-2014-8517.patch of Package tnftp

Overview Repositories Revisions Requests Users Attributes Meta

File tnftp-cve-2014-8517.patch of Package tnftp (Revision 37679eb9e210915aad403cc0cb49553d)

Currently displaying revision 37679eb9e210915aad403cc0cb49553d , Show latest

diff -urN tnftp-20130505.old/src/fetch.c tnftp-20130505/src/fetch.c
--- tnftp-20130505.old/src/fetch.c	2014-10-30 10:55:11.381328347 +0100
+++ tnftp-20130505/src/fetch.c	2014-10-30 13:57:04.404327045 +0100
@@ -571,7 +571,7 @@
 	url_decode(decodedpath);
 
 	if (outfile)
-		savefile = ftp_strdup(outfile);
+		savefile = outfile;
 	else {
 		cp = strrchr(decodedpath, '/');		/* find savefile */
 		if (cp != NULL)
@@ -595,8 +595,7 @@
 	rangestart = rangeend = entitylen = -1;
 	mtime = -1;
 	if (restartautofetch) {
-		if (strcmp(savefile, "-") != 0 && *savefile != '|' &&
-		    stat(savefile, &sb) == 0)
+		if (stat(savefile, &sb) == 0)
 			restart_point = sb.st_size;
 	}
 	if (urltype == FILE_URL_T) {		/* file:// URLs */
@@ -1139,19 +1138,26 @@
 			goto cleanup_fetch_url;
 		}
 	}		/* end of ftp:// or http:// specific setup */
+       /* Open the output file. */
 
-			/* Open the output file. */
-	if (strcmp(savefile, "-") == 0) {
-		fout = stdout;
-	} else if (*savefile == '|') {
-		oldintp = xsignal(SIGPIPE, SIG_IGN);
-		fout = popen(savefile + 1, "w");
-		if (fout == NULL) {
-			warn("Can't execute `%s'", savefile + 1);
-			goto cleanup_fetch_url;
+       /*
+	* Only trust filenames with special meaning if they came from
+	* the command line
+	*/
+       if (outfile == savefile) {
+	       if (strcmp(savefile, "-") == 0) {
+		       fout = stdout;
+	       } else if (*savefile == '|') {
+		       oldintp = xsignal(SIGPIPE, SIG_IGN);
+		       fout = popen(savefile + 1, "w");
+		       if (fout == NULL) {
+			       warn("Can't execute `%s'", savefile + 1);
+			       goto cleanup_fetch_url;
+		       }
+		       closefunc = pclose;
 		}
-		closefunc = pclose;
-	} else {
+	}
+	if (fout == NULL) {
 		if ((rangeend != -1 && rangeend <= restart_point) ||
 		    (rangestart == -1 && filesize != -1 && filesize <= restart_point)) {
 			/* already done */
@@ -1362,7 +1368,8 @@
 		(*closefunc)(fout);
 	if (res0)
 		freeaddrinfo(res0);
-	FREEPTR(savefile);
+	if (savefile != outfile)
+		FREEPTR(savefile);
 	FREEPTR(uuser);
 	if (pass != NULL)
 		memset(pass, 0, strlen(pass));

Places

File tnftp-cve-2014-8517.patch of Package tnftp (Revision 37679eb9e210915aad403cc0cb49553d)

Places