mirror of
https://github.com/Mauler125/r5sdk.git
synced 2025-02-09 19:15:03 +01:00
Fix CVE-2020-8285
Merge: curl/curl@69a358f218 Note: due to the many updates between the curl version this has been fixed in, and the one used in the SDK, the function was slightly different. The code has been tested however, after implementing the fix for this particular version of the library, the code appears to work perfectly with the vuln being fixed (tested on an FTP server with 10k files in the directory).
This commit is contained in:
Kawe Mazidjatari
parent
5a9711878b
commit
c38a5f214f
212
r5dev/thirdparty/curl/ftp.c
vendored
212
r5dev/thirdparty/curl/ftp.c
vendored
@ -3875,122 +3875,124 @@ static CURLcode init_wc_data(struct connectdata *conn)
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
||||
/* This is called recursively */
|
||||
static CURLcode wc_statemach(struct connectdata *conn)
|
||||
{
|
||||
struct WildcardData * const wildcard = &(conn->data->wildcard);
|
||||
CURLcode result = CURLE_OK;
|
||||
|
||||
switch(wildcard->state) {
|
||||
case CURLWC_INIT:
|
||||
result = init_wc_data(conn);
|
||||
if(wildcard->state == CURLWC_CLEAN)
|
||||
/* only listing! */
|
||||
break;
|
||||
wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
|
||||
break;
|
||||
|
||||
case CURLWC_MATCHING: {
|
||||
/* In this state is LIST response successfully parsed, so lets restore
|
||||
previous WRITEFUNCTION callback and WRITEDATA pointer */
|
||||
struct ftp_wc_tmpdata *ftp_tmp = wildcard->tmp;
|
||||
conn->data->set.fwrite_func = ftp_tmp->backup.write_function;
|
||||
conn->data->set.out = ftp_tmp->backup.file_descriptor;
|
||||
ftp_tmp->backup.write_function = ZERO_NULL;
|
||||
ftp_tmp->backup.file_descriptor = NULL;
|
||||
wildcard->state = CURLWC_DOWNLOADING;
|
||||
|
||||
if(Curl_ftp_parselist_geterror(ftp_tmp->parser)) {
|
||||
/* error found in LIST parsing */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
return wc_statemach(conn);
|
||||
}
|
||||
if(wildcard->filelist.size == 0) {
|
||||
/* no corresponding file */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
return CURLE_REMOTE_FILE_NOT_FOUND;
|
||||
}
|
||||
return wc_statemach(conn);
|
||||
}
|
||||
|
||||
case CURLWC_DOWNLOADING: {
|
||||
/* filelist has at least one file, lets get first one */
|
||||
struct ftp_conn *ftpc = &conn->proto.ftpc;
|
||||
struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
|
||||
|
||||
char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
|
||||
if(!tmp_path)
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
|
||||
/* switch default "state.pathbuffer" and tmp_path, good to see
|
||||
ftp_parse_url_path function to understand this trick */
|
||||
Curl_safefree(conn->data->state.pathbuffer);
|
||||
conn->data->state.pathbuffer = tmp_path;
|
||||
conn->data->state.path = tmp_path;
|
||||
|
||||
infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
|
||||
if(conn->data->set.chunk_bgn) {
|
||||
long userresponse = conn->data->set.chunk_bgn(
|
||||
finfo, wildcard->customptr, (int)wildcard->filelist.size);
|
||||
switch(userresponse) {
|
||||
case CURL_CHUNK_BGN_FUNC_SKIP:
|
||||
infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
|
||||
finfo->filename);
|
||||
wildcard->state = CURLWC_SKIP;
|
||||
return wc_statemach(conn);
|
||||
case CURL_CHUNK_BGN_FUNC_FAIL:
|
||||
return CURLE_CHUNK_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
if(finfo->filetype != CURLFILETYPE_FILE) {
|
||||
wildcard->state = CURLWC_SKIP;
|
||||
return wc_statemach(conn);
|
||||
}
|
||||
|
||||
if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
|
||||
ftpc->known_filesize = finfo->size;
|
||||
|
||||
result = ftp_parse_url_path(conn);
|
||||
if(result)
|
||||
for(;;) {
|
||||
switch(wildcard->state) {
|
||||
case CURLWC_INIT:
|
||||
result = init_wc_data(conn);
|
||||
if(wildcard->state == CURLWC_CLEAN)
|
||||
/* only listing! */
|
||||
return result;
|
||||
wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
|
||||
return result;
|
||||
|
||||
/* we don't need the Curl_fileinfo of first file anymore */
|
||||
Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
||||
case CURLWC_MATCHING: {
|
||||
/* In this state is LIST response successfully parsed, so lets restore
|
||||
previous WRITEFUNCTION callback and WRITEDATA pointer */
|
||||
struct ftp_wc_tmpdata *ftpwc = wildcard->tmp;
|
||||
conn->data->set.fwrite_func = ftpwc->backup.write_function;
|
||||
conn->data->set.out = ftpwc->backup.file_descriptor;
|
||||
ftpwc->backup.write_function = ZERO_NULL;
|
||||
ftpwc->backup.file_descriptor = NULL;
|
||||
wildcard->state = CURLWC_DOWNLOADING;
|
||||
|
||||
if(wildcard->filelist.size == 0) { /* remains only one file to down. */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
/* after that will be ftp_do called once again and no transfer
|
||||
will be done because of CURLWC_CLEAN state */
|
||||
return CURLE_OK;
|
||||
if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
|
||||
/* error found in LIST parsing */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
continue;
|
||||
}
|
||||
if(wildcard->filelist.size == 0) {
|
||||
/* no corresponding file */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
return CURLE_REMOTE_FILE_NOT_FOUND;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} break;
|
||||
|
||||
case CURLWC_SKIP: {
|
||||
if(conn->data->set.chunk_end)
|
||||
conn->data->set.chunk_end(conn->data->wildcard.customptr);
|
||||
Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
||||
wildcard->state = (wildcard->filelist.size == 0) ?
|
||||
CURLWC_CLEAN : CURLWC_DOWNLOADING;
|
||||
return wc_statemach(conn);
|
||||
case CURLWC_DOWNLOADING: {
|
||||
/* filelist has at least one file, lets get first one */
|
||||
struct ftp_conn *ftpc = &conn->proto.ftpc;
|
||||
struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
|
||||
|
||||
char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
|
||||
if(!tmp_path)
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
|
||||
/* switch default "state.pathbuffer" and tmp_path, good to see
|
||||
ftp_parse_url_path function to understand this trick */
|
||||
Curl_safefree(conn->data->state.pathbuffer);
|
||||
conn->data->state.pathbuffer = tmp_path;
|
||||
conn->data->state.path = tmp_path;
|
||||
|
||||
infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
|
||||
if(conn->data->set.chunk_bgn) {
|
||||
long userresponse = conn->data->set.chunk_bgn(
|
||||
finfo, wildcard->customptr, (int)wildcard->filelist.size);
|
||||
switch(userresponse) {
|
||||
case CURL_CHUNK_BGN_FUNC_SKIP:
|
||||
infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
|
||||
finfo->filename);
|
||||
wildcard->state = CURLWC_SKIP;
|
||||
continue;
|
||||
case CURL_CHUNK_BGN_FUNC_FAIL:
|
||||
return CURLE_CHUNK_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
if(finfo->filetype != CURLFILETYPE_FILE) {
|
||||
wildcard->state = CURLWC_SKIP;
|
||||
continue;
|
||||
}
|
||||
|
||||
if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
|
||||
ftpc->known_filesize = finfo->size;
|
||||
|
||||
result = ftp_parse_url_path(conn);
|
||||
if(result)
|
||||
return result;
|
||||
|
||||
/* we don't need the Curl_fileinfo of first file anymore */
|
||||
Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
||||
|
||||
if(wildcard->filelist.size == 0) { /* remains only one file to down. */
|
||||
wildcard->state = CURLWC_CLEAN;
|
||||
/* after that will be ftp_do called once again and no transfer
|
||||
will be done because of CURLWC_CLEAN state */
|
||||
return CURLE_OK;
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
case CURLWC_SKIP: {
|
||||
if(conn->data->set.chunk_end)
|
||||
conn->data->set.chunk_end(conn->data->wildcard.customptr);
|
||||
Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
|
||||
wildcard->state = (wildcard->filelist.size == 0) ?
|
||||
CURLWC_CLEAN : CURLWC_DOWNLOADING;
|
||||
continue;
|
||||
}
|
||||
|
||||
case CURLWC_CLEAN: {
|
||||
struct ftp_wc_tmpdata*ftpwc = wildcard->tmp;
|
||||
result = CURLE_OK;
|
||||
if(ftpwc)
|
||||
result = Curl_ftp_parselist_geterror(ftpwc->parser);
|
||||
|
||||
wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
|
||||
return result;
|
||||
}
|
||||
|
||||
case CURLWC_DONE:
|
||||
case CURLWC_ERROR:
|
||||
case CURLWC_CLEAR:
|
||||
return result;
|
||||
}
|
||||
}
|
||||
|
||||
case CURLWC_CLEAN: {
|
||||
struct ftp_wc_tmpdata *ftp_tmp = wildcard->tmp;
|
||||
result = CURLE_OK;
|
||||
if(ftp_tmp)
|
||||
result = Curl_ftp_parselist_geterror(ftp_tmp->parser);
|
||||
|
||||
wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
|
||||
} break;
|
||||
|
||||
case CURLWC_DONE:
|
||||
case CURLWC_ERROR:
|
||||
case CURLWC_CLEAR:
|
||||
break;
|
||||
}
|
||||
|
||||
return result;
|
||||
/* UNREACHABLE */
|
||||
}
|
||||
|
||||
/***********************************************************************
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user