You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
259 lines
8.9 KiB
259 lines
8.9 KiB
From 22b3d1cf0216f4369f01678c587da265c2e465af Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Sat, 28 Nov 2020 00:27:21 +0100
|
|
Subject: [PATCH] ftp: make wc_statemach loop instead of recurse
|
|
|
|
CVE-2020-8285
|
|
|
|
Fixes #6255
|
|
Bug: https://curl.se/docs/CVE-2020-8285.html
|
|
Reported-by: xnynx on github
|
|
|
|
Upstream-commit: 69a358f2186e04cf44698b5100332cbf1ee7f01d
|
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
---
|
|
lib/ftp.c | 204 +++++++++++++++++++++++++++---------------------------
|
|
1 file changed, 103 insertions(+), 101 deletions(-)
|
|
|
|
diff --git a/lib/ftp.c b/lib/ftp.c
|
|
index 7dbf080..482ab3a 100644
|
|
--- a/lib/ftp.c
|
|
+++ b/lib/ftp.c
|
|
@@ -3786,130 +3786,132 @@ static CURLcode init_wc_data(struct connectdata *conn)
|
|
return result;
|
|
}
|
|
|
|
-/* This is called recursively */
|
|
static CURLcode wc_statemach(struct connectdata *conn)
|
|
{
|
|
struct WildcardData * const wildcard = &(conn->data->wildcard);
|
|
CURLcode result = CURLE_OK;
|
|
|
|
- switch(wildcard->state) {
|
|
- case CURLWC_INIT:
|
|
- result = init_wc_data(conn);
|
|
- if(wildcard->state == CURLWC_CLEAN)
|
|
- /* only listing! */
|
|
- break;
|
|
- wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
|
|
- break;
|
|
+ for(;;) {
|
|
+ switch(wildcard->state) {
|
|
+ case CURLWC_INIT:
|
|
+ result = init_wc_data(conn);
|
|
+ if(wildcard->state == CURLWC_CLEAN)
|
|
+ /* only listing! */
|
|
+ return result;
|
|
+ wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
|
|
+ return result;
|
|
|
|
- case CURLWC_MATCHING: {
|
|
- /* In this state is LIST response successfully parsed, so lets restore
|
|
- previous WRITEFUNCTION callback and WRITEDATA pointer */
|
|
- struct ftp_wc *ftpwc = wildcard->protdata;
|
|
- conn->data->set.fwrite_func = ftpwc->backup.write_function;
|
|
- conn->data->set.out = ftpwc->backup.file_descriptor;
|
|
- ftpwc->backup.write_function = ZERO_NULL;
|
|
- ftpwc->backup.file_descriptor = NULL;
|
|
- wildcard->state = CURLWC_DOWNLOADING;
|
|
-
|
|
- if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
|
|
- /* error found in LIST parsing */
|
|
- wildcard->state = CURLWC_CLEAN;
|
|
- return wc_statemach(conn);
|
|
- }
|
|
- if(wildcard->filelist.size == 0) {
|
|
- /* no corresponding file */
|
|
- wildcard->state = CURLWC_CLEAN;
|
|
- return CURLE_REMOTE_FILE_NOT_FOUND;
|
|
+ case CURLWC_MATCHING: {
|
|
+ /* In this state is LIST response successfully parsed, so lets restore
|
|
+ previous WRITEFUNCTION callback and WRITEDATA pointer */
|
|
+ struct ftp_wc *ftpwc = wildcard->protdata;
|
|
+ conn->data->set.fwrite_func = ftpwc->backup.write_function;
|
|
+ conn->data->set.out = ftpwc->backup.file_descriptor;
|
|
+ ftpwc->backup.write_function = ZERO_NULL;
|
|
+ ftpwc->backup.file_descriptor = NULL;
|
|
+ wildcard->state = CURLWC_DOWNLOADING;
|
|
+
|
|
+ if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
|
|
+ /* error found in LIST parsing */
|
|
+ wildcard->state = CURLWC_CLEAN;
|
|
+ continue;
|
|
+ }
|
|
+ if(wildcard->filelist.size == 0) {
|
|
+ /* no corresponding file */
|
|
+ wildcard->state = CURLWC_CLEAN;
|
|
+ return CURLE_REMOTE_FILE_NOT_FOUND;
|
|
+ }
|
|
+ continue;
|
|
}
|
|
- return wc_statemach(conn);
|
|
- }
|
|
|
|
- case CURLWC_DOWNLOADING: {
|
|
- /* filelist has at least one file, lets get first one */
|
|
- struct ftp_conn *ftpc = &conn->proto.ftpc;
|
|
- struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
|
|
+ case CURLWC_DOWNLOADING: {
|
|
+ /* filelist has at least one file, lets get first one */
|
|
+ struct ftp_conn *ftpc = &conn->proto.ftpc;
|
|
+ struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
|
|
|
|
- char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
|
|
- if(!tmp_path)
|
|
- return CURLE_OUT_OF_MEMORY;
|
|
+ char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
|
|
+ if(!tmp_path)
|
|
+ return CURLE_OUT_OF_MEMORY;
|
|
|
|
- /* switch default "state.pathbuffer" and tmp_path, good to see
|
|
- ftp_parse_url_path function to understand this trick */
|
|
- Curl_safefree(conn->data->state.pathbuffer);
|
|
- conn->data->state.pathbuffer = tmp_path;
|
|
- conn->data->state.path = tmp_path;
|
|
-
|
|
- infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
|
|
- if(conn->data->set.chunk_bgn) {
|
|
- long userresponse;
|
|
- Curl_set_in_callback(conn->data, true);
|
|
- userresponse = conn->data->set.chunk_bgn(
|
|
- finfo, wildcard->customptr, (int)wildcard->filelist.size);
|
|
- Curl_set_in_callback(conn->data, false);
|
|
- switch(userresponse) {
|
|
- case CURL_CHUNK_BGN_FUNC_SKIP:
|
|
- infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
|
|
- finfo->filename);
|
|
- wildcard->state = CURLWC_SKIP;
|
|
- return wc_statemach(conn);
|
|
- case CURL_CHUNK_BGN_FUNC_FAIL:
|
|
- return CURLE_CHUNK_FAILED;
|
|
+ /* switch default "state.pathbuffer" and tmp_path, good to see
|
|
+ ftp_parse_url_path function to understand this trick */
|
|
+ Curl_safefree(conn->data->state.pathbuffer);
|
|
+ conn->data->state.pathbuffer = tmp_path;
|
|
+ conn->data->state.path = tmp_path;
|
|
+
|
|
+ infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
|
|
+ if(conn->data->set.chunk_bgn) {
|
|
+ long userresponse;
|
|
+ Curl_set_in_callback(conn->data, true);
|
|
+ userresponse = conn->data->set.chunk_bgn(
|
|
+ finfo, wildcard->customptr, (int)wildcard->filelist.size);
|
|
+ Curl_set_in_callback(conn->data, false);
|
|
+ switch(userresponse) {
|
|
+ case CURL_CHUNK_BGN_FUNC_SKIP:
|
|
+ infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
|
|
+ finfo->filename);
|
|
+ wildcard->state = CURLWC_SKIP;
|
|
+ continue;
|
|
+ case CURL_CHUNK_BGN_FUNC_FAIL:
|
|
+ return CURLE_CHUNK_FAILED;
|
|
+ }
|
|
}
|
|
- }
|
|
|
|
- if(finfo->filetype != CURLFILETYPE_FILE) {
|
|
- wildcard->state = CURLWC_SKIP;
|
|
- return wc_statemach(conn);
|
|
- }
|
|
+ if(finfo->filetype != CURLFILETYPE_FILE) {
|
|
+ wildcard->state = CURLWC_SKIP;
|
|
+ continue;
|
|
+ }
|
|
|
|
- if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
|
|
- ftpc->known_filesize = finfo->size;
|
|
+ if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
|
|
+ ftpc->known_filesize = finfo->size;
|
|
|
|
- result = ftp_parse_url_path(conn);
|
|
- if(result)
|
|
- return result;
|
|
+ result = ftp_parse_url_path(conn);
|
|
+ if(result)
|
|
+ return result;
|
|
|
|
- /* we don't need the Curl_fileinfo of first file anymore */
|
|
- Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
|
+ /* we don't need the Curl_fileinfo of first file anymore */
|
|
+ Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
|
|
|
- if(wildcard->filelist.size == 0) { /* remains only one file to down. */
|
|
- wildcard->state = CURLWC_CLEAN;
|
|
- /* after that will be ftp_do called once again and no transfer
|
|
- will be done because of CURLWC_CLEAN state */
|
|
- return CURLE_OK;
|
|
+ if(wildcard->filelist.size == 0) { /* remains only one file to down. */
|
|
+ wildcard->state = CURLWC_CLEAN;
|
|
+ /* after that will be ftp_do called once again and no transfer
|
|
+ will be done because of CURLWC_CLEAN state */
|
|
+ return CURLE_OK;
|
|
+ }
|
|
+ return result;
|
|
}
|
|
- } break;
|
|
|
|
- case CURLWC_SKIP: {
|
|
- if(conn->data->set.chunk_end) {
|
|
- Curl_set_in_callback(conn->data, true);
|
|
- conn->data->set.chunk_end(conn->data->wildcard.customptr);
|
|
- Curl_set_in_callback(conn->data, false);
|
|
+ case CURLWC_SKIP: {
|
|
+ if(conn->data->set.chunk_end) {
|
|
+ Curl_set_in_callback(conn->data, true);
|
|
+ conn->data->set.chunk_end(conn->data->wildcard.customptr);
|
|
+ Curl_set_in_callback(conn->data, false);
|
|
+ }
|
|
+ Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
|
+ wildcard->state = (wildcard->filelist.size == 0) ?
|
|
+ CURLWC_CLEAN : CURLWC_DOWNLOADING;
|
|
+ continue;
|
|
}
|
|
- Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
|
- wildcard->state = (wildcard->filelist.size == 0) ?
|
|
- CURLWC_CLEAN : CURLWC_DOWNLOADING;
|
|
- return wc_statemach(conn);
|
|
- }
|
|
|
|
- case CURLWC_CLEAN: {
|
|
- struct ftp_wc *ftpwc = wildcard->protdata;
|
|
- result = CURLE_OK;
|
|
- if(ftpwc)
|
|
- result = Curl_ftp_parselist_geterror(ftpwc->parser);
|
|
+ case CURLWC_CLEAN: {
|
|
+ struct ftp_wc *ftpwc = wildcard->protdata;
|
|
+ result = CURLE_OK;
|
|
+ if(ftpwc)
|
|
+ result = Curl_ftp_parselist_geterror(ftpwc->parser);
|
|
|
|
- wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
|
|
- } break;
|
|
+ wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
|
|
+ return result;
|
|
+ }
|
|
|
|
- case CURLWC_DONE:
|
|
- case CURLWC_ERROR:
|
|
- case CURLWC_CLEAR:
|
|
- if(wildcard->dtor)
|
|
- wildcard->dtor(wildcard->protdata);
|
|
- break;
|
|
+ case CURLWC_DONE:
|
|
+ case CURLWC_ERROR:
|
|
+ case CURLWC_CLEAR:
|
|
+ if(wildcard->dtor)
|
|
+ wildcard->dtor(wildcard->protdata);
|
|
+ return result;
|
|
+ }
|
|
}
|
|
-
|
|
- return result;
|
|
+ /* UNREACHABLE */
|
|
}
|
|
|
|
/***********************************************************************
|
|
--
|
|
2.26.2
|
|
|