Subject: security wu-ftpd

From: Alain Magloire <[email-masked]>
Date: Wed, 22 Jan 1997 18:31:26 -0500 (EST)

hello 
 Hello `Anders Thulin' pointed a buffer overrun in
the ftpd_popen()(see archive).
I did successfully manage to get a SIGVEC
in wu-ftpd-*-beta-11, I do believe that beta-12 still
have the same flaw. In a previous posting Mr Barber
said this will be corrected in beta-13.
Until then, here's a patch. It was done against beta-12.

Thanks to `Anders Thulin' for bouncing idea's against

if yu need the patch for beta-11 or you
have a better solution, or I just missed something,
 please email

-- 
Bonne anne'e, alain

*** ./popen.c.orig	Wed Jan 22 18:02:00 1997
--- ./popen.c	Wed Jan 22 18:05:35 1997
***************
*** 48,53 ****
--- 48,56 ----
  #include <sys/resource.h>
  #endif
  
+ #define MAX_ARGC 100
+ #define MAX_GARGC 1000
+ 
  /* 
   * Special version of popen which avoids call to shell.  This insures noone
   * may create a pipe to a hidden program as a side effect of a list or dir
***************
*** 73,80 ****
        pdes[2],
        pid,i;
      char **pop,
!      *argv[100],
!      *gargv[1000],
       *vv[2];
  #ifdef __STDC__
      extern char **ftpglob(register char *v),
--- 76,83 ----
        pdes[2],
        pid,i;
      char **pop,
!      *argv[MAX_ARGC],
!      *gargv[MAX_GARGC],
       *vv[2];
  #ifdef __STDC__
      extern char **ftpglob(register char *v),
***************
*** 120,131 ****
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
!         if (argc > 100) return(NULL); /* AUSCERT Report */
! 
      /* glob each piece */
      gargv[0] = argv[0];
      for (gargc = argc = 1; argv[argc]; argc++) {
--- 123,134 ----
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;; cp = NULL) {
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
!         if (argc > MAX_ARGC) return(NULL); /* AUSCERT Report */
!     }
      /* glob each piece */
      gargv[0] = argv[0];
      for (gargc = argc = 1; argv[argc]; argc++) {
***************
*** 135,141 ****
              pop = copyblk(vv);
          }
          argv[argc] = (char *) pop;  /* save to free later */
!         while (*pop && gargc < 1000)
              gargv[gargc++] = *pop++;
      }
      gargv[gargc] = NULL;
--- 138,144 ----
              pop = copyblk(vv);
          }
          argv[argc] = (char *) pop;  /* save to free later */
!         while (*pop && gargc < MAX_GARGC)
              gargv[gargc++] = *pop++;
      }
      gargv[gargc] = NULL;