fix: prevent segfault if malicious server sends 1 GB of data through ftpNLST.

[platform/upstream/rpm.git] / rpmio / rpmrpc.c

diff --git a/rpmio/rpmrpc.c b/rpmio/rpmrpc.c
index 8154415..9f3be35 100644 (file)
--- a/rpmio/rpmrpc.c
+++ b/rpmio/rpmrpc.c
@@ -9,10 +9,10 @@
 #endif
 
 #include <rpmio_internal.h>
-#include <popt.h>
 #include "ugid.h"
 #include "debug.h"
 
+/*@access DIR@*/
 /*@access FD_t@*/
 /*@access urlinfo@*/
 
@@ -903,6 +903,7 @@ static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
        /* XXX FIXME: realloc ftpBuf if < ~128 chars remain */
        if ((ftpBufAlloced - bufLength) < (1024+80)) {
            ftpBufAlloced <<= 2;
+           assert(ftpBufAlloced < (8*1024*1024));
            ftpBuf = xrealloc(ftpBuf, ftpBufAlloced);
        }
        s = se = ftpBuf + bufLength;
@@ -1022,7 +1023,7 @@ static const char * statstr(const struct stat * st,
        (unsigned)st->st_dev,
        (unsigned)st->st_ino,
        st->st_mode,
-       st->st_nlink,
+       (unsigned)st->st_nlink,
        st->st_uid,
        st->st_gid,
        (unsigned)st->st_rdev,
@@ -1090,6 +1091,21 @@ struct __dirstream {
 #endif
 };
 
+#if !defined(DT_DIR)
+# define DT_UNKNOWN    0
+# define DT_FIFO       1
+# define DT_CHR                2
+# define DT_DIR                4
+# define DT_BLK                6
+# define DT_REG                8
+# define DT_LNK                10
+# define DT_SOCK       12
+# define DT_WHT                14
+typedef struct __dirstream *   FTPDIR;
+#else
+typedef DIR *                  FTPDIR;
+#endif
+
 /*@unchecked@*/
 static int ftpmagicdir = 0x8440291;
 #define        ISFTPMAGIC(_dir) (!memcmp((_dir), &ftpmagicdir, sizeof(ftpmagicdir)))
@@ -1101,7 +1117,7 @@ static DIR * ftpOpendir(const char * path)
        /*@globals fileSystem, internalState @*/
        /*@modifies fileSystem, internalState @*/
 {
-    DIR * dir;
+    FTPDIR mydir;
     struct dirent * dp;
     size_t nb;
     const char * s, * sb, * se;
@@ -1149,21 +1165,23 @@ fprintf(stderr, "*** ftpOpendir(%s)\n", path);
        }
     }
 
-    nb += sizeof(*dir) + sizeof(*dp) + ((ac + 1) * sizeof(*av)) + (ac + 1);
-    dir = xcalloc(1, nb);
+    nb += sizeof(*mydir) + sizeof(*dp) + ((ac + 1) * sizeof(*av)) + (ac + 1);
+    mydir = xcalloc(1, nb);
     /*@-abstract@*/
-    dp = (struct dirent *) (dir + 1);
+    dp = (struct dirent *) (mydir + 1);
     av = (const char **) (dp + 1);
     dt = (char *) (av + (ac + 1));
     t = (char *) (dt + ac + 1);
     /*@=abstract@*/
 
-    dir->fd = ftpmagicdir;
-    dir->data = (char *) dp;
-    dir->allocation = nb;
-    dir->size = ac;
-    dir->offset = -1;
-    dir->filepos = 0;
+    mydir->fd = ftpmagicdir;
+/*@-usereleased@*/
+    mydir->data = (char *) dp;
+/*@=usereleased@*/
+    mydir->allocation = nb;
+    mydir->size = ac;
+    mydir->offset = -1;
+    mydir->filepos = 0;
 
     ac = 0;
     /*@-dependenttrans -unrecog@*/
@@ -1227,7 +1245,9 @@ fprintf(stderr, "*** ftpOpendir(%s)\n", path);
     }
     av[ac] = NULL;
 
-    return dir;
+/*@-kepttrans@*/
+    return (DIR *) mydir;
+/*@=kepttrans@*/
 }
 /*@=boundswrite@*/
 
@@ -1236,6 +1256,7 @@ static struct dirent * ftpReaddir(DIR * dir)
        /*@globals fileSystem @*/
        /*@modifies fileSystem @*/
 {
+    FTPDIR mydir = (FTPDIR)dir;
     struct dirent * dp;
     const char ** av;
     unsigned char * dt;
@@ -1243,37 +1264,40 @@ static struct dirent * ftpReaddir(DIR * dir)
     int i;
 
     /*@+voidabstract@*/
-    if (dir == NULL || !ISFTPMAGIC(dir) || dir->data == NULL) {
+    if (mydir == NULL || !ISFTPMAGIC(mydir) || mydir->data == NULL) {
        /* XXX TODO: EBADF errno. */
        return NULL;
     }
     /*@=voidabstract@*/
 
-    dp = (struct dirent *) dir->data;
+    dp = (struct dirent *) mydir->data;
     av = (const char **) (dp + 1);
-    ac = dir->size;
+    ac = mydir->size;
     dt = (char *) (av + (ac + 1));
-    i = dir->offset + 1;
+    i = mydir->offset + 1;
 
 /*@-boundsread@*/
     if (i < 0 || i >= ac || av[i] == NULL)
        return NULL;
 /*@=boundsread@*/
 
-    dir->offset = i;
+    mydir->offset = i;
 
     /* XXX glob(3) uses REAL_DIR_ENTRY(dp) test on d_ino */
     dp->d_ino = i + 1;         /* W2DO? */
-    dp->d_off = 0;             /* W2DO? */
     dp->d_reclen = 0;          /* W2DO? */
+
+#if !defined(hpux) && !defined(sun)
+    dp->d_off = 0;             /* W2DO? */
 /*@-boundsread@*/
     dp->d_type = dt[i];
 /*@=boundsread@*/
+#endif
 
     strncpy(dp->d_name, av[i], sizeof(dp->d_name));
 /*@+voidabstract@*/
 if (_ftp_debug)
-fprintf(stderr, "*** ftpReaddir(%p) %p \"%s\"\n", (void *)dir, dp, dp->d_name);
+fprintf(stderr, "*** ftpReaddir(%p) %p \"%s\"\n", (void *)mydir, dp, dp->d_name);
 /*@=voidabstract@*/
     
     return dp;
@@ -1284,16 +1308,18 @@ static int ftpClosedir(/*@only@*/ DIR * dir)
        /*@globals fileSystem @*/
        /*@modifies dir, fileSystem @*/
 {
+    FTPDIR mydir = (FTPDIR)dir;
+
     /*@+voidabstract@*/
 if (_ftp_debug)
-fprintf(stderr, "*** ftpClosedir(%p)\n", (void *)dir);
-    if (dir == NULL || !ISFTPMAGIC(dir)) {
+fprintf(stderr, "*** ftpClosedir(%p)\n", (void *)mydir);
+    if (mydir == NULL || !ISFTPMAGIC(mydir)) {
        /* XXX TODO: EBADF errno. */
        return -1;
     }
-    free((void *)dir);
+    free((void *)mydir);
     /*@=voidabstract@*/
-    dir = NULL;
+    mydir = NULL;
     return 0;
 }