fix: prevent segfault if malicious server sends 1 GB of data through ftpNLST.

[platform/upstream/rpm.git] / rpmio / rpmrpc.c

diff --git a/rpmio/rpmrpc.c b/rpmio/rpmrpc.c
index 939d061..9f3be35 100644 (file)
--- a/rpmio/rpmrpc.c
+++ b/rpmio/rpmrpc.c
@@ -9,17 +9,17 @@
 #endif
 
 #include <rpmio_internal.h>
-#include <popt.h>
 #include "ugid.h"
 #include "debug.h"
 
+/*@access DIR@*/
 /*@access FD_t@*/
 /*@access urlinfo@*/
 
 /* =============================================================== */
 static int ftpMkdir(const char * path, /*@unused@*/ mode_t mode)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
     int rc;
     if ((rc = ftpCmd("MKD", path, NULL)) != 0)
@@ -34,22 +34,22 @@ static int ftpMkdir(const char * path, /*@unused@*/ mode_t mode)
 }
 
 static int ftpChdir(const char * path)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
     return ftpCmd("CWD", path, NULL);
 }
 
 static int ftpRmdir(const char * path)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
     return ftpCmd("RMD", path, NULL);
 }
 
 static int ftpRename(const char * oldpath, const char * newpath)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
     int rc;
     if ((rc = ftpCmd("RNFR", oldpath, NULL)) != 0)
@@ -58,8 +58,8 @@ static int ftpRename(const char * oldpath, const char * newpath)
 }
 
 static int ftpUnlink(const char * path)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
     return ftpCmd("DELE", path, NULL);
 }
@@ -297,6 +297,7 @@ vfs_split_text (char *p)
 }
 /*@=boundswrite@*/
 
+/*@-boundsread@*/
 static int
 is_num (int idx)
        /*@*/
@@ -305,7 +306,9 @@ is_num (int idx)
        return 0;
     return 1;
 }
+/*@=boundsread@*/
 
+/*@-boundsread@*/
 static int
 is_dos_date(/*@null@*/ const char *str)
        /*@*/
@@ -315,6 +318,7 @@ is_dos_date(/*@null@*/ const char *str)
        return 1;
     return 0;
 }
+/*@=boundsread@*/
 
 static int
 is_week (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
@@ -821,8 +825,8 @@ static /*@only@*/ char * ftpBuf = NULL;
 static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
                /*@out@*/ /*@null@*/ struct stat * st,
                /*@out@*/ /*@null@*/ char * rlbuf, size_t rlbufsiz)
-       /*@globals fileSystem @*/
-       /*@modifies *st, *rlbuf, fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies *st, *rlbuf, fileSystem, internalState @*/
 {
     FD_t fd;
     const char * path;
@@ -899,6 +903,7 @@ static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
        /* XXX FIXME: realloc ftpBuf if < ~128 chars remain */
        if ((ftpBufAlloced - bufLength) < (1024+80)) {
            ftpBufAlloced <<= 2;
+           assert(ftpBufAlloced < (8*1024*1024));
            ftpBuf = xrealloc(ftpBuf, ftpBufAlloced);
        }
        s = se = ftpBuf + bufLength;
@@ -1018,7 +1023,7 @@ static const char * statstr(const struct stat * st,
        (unsigned)st->st_dev,
        (unsigned)st->st_ino,
        st->st_mode,
-       st->st_nlink,
+       (unsigned)st->st_nlink,
        st->st_uid,
        st->st_gid,
        (unsigned)st->st_rdev,
@@ -1030,8 +1035,8 @@ static const char * statstr(const struct stat * st,
 static int ftp_st_ino = 0xdead0000;
 
 static int ftpStat(const char * path, /*@out@*/ struct stat *st)
-       /*@globals fileSystem @*/
-       /*@modifies *st, fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies *st, fileSystem, internalState @*/
 {
     char buf[1024];
     int rc;
@@ -1047,8 +1052,8 @@ fprintf(stderr, "*** ftpStat(%s) rc %d\n%s", path, rc, statstr(st, buf));
 }
 
 static int ftpLstat(const char * path, /*@out@*/ struct stat *st)
-       /*@globals fileSystem @*/
-       /*@modifies *st, fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies *st, fileSystem, internalState @*/
 {
     char buf[1024];
     int rc;
@@ -1064,8 +1069,8 @@ fprintf(stderr, "*** ftpLstat(%s) rc %d\n%s\n", path, rc, statstr(st, buf));
 }
 
 static int ftpReadlink(const char * path, /*@out@*/ char * buf, size_t bufsiz)
-       /*@globals fileSystem @*/
-       /*@modifies *buf, fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies *buf, fileSystem, internalState @*/
 {
     int rc;
     rc = ftpNLST(path, DO_FTP_READLINK, NULL, buf, bufsiz);
@@ -1086,6 +1091,21 @@ struct __dirstream {
 #endif
 };
 
+#if !defined(DT_DIR)
+# define DT_UNKNOWN    0
+# define DT_FIFO       1
+# define DT_CHR                2
+# define DT_DIR                4
+# define DT_BLK                6
+# define DT_REG                8
+# define DT_LNK                10
+# define DT_SOCK       12
+# define DT_WHT                14
+typedef struct __dirstream *   FTPDIR;
+#else
+typedef DIR *                  FTPDIR;
+#endif
+
 /*@unchecked@*/
 static int ftpmagicdir = 0x8440291;
 #define        ISFTPMAGIC(_dir) (!memcmp((_dir), &ftpmagicdir, sizeof(ftpmagicdir)))
@@ -1094,10 +1114,10 @@ static int ftpmagicdir = 0x8440291;
 /*@-type@*/ /* FIX: abstract DIR */
 /*@null@*/
 static DIR * ftpOpendir(const char * path)
-       /*@globals fileSystem @*/
-       /*@modifies fileSystem @*/
+       /*@globals fileSystem, internalState @*/
+       /*@modifies fileSystem, internalState @*/
 {
-    DIR * dir;
+    FTPDIR mydir;
     struct dirent * dp;
     size_t nb;
     const char * s, * sb, * se;
@@ -1145,21 +1165,23 @@ fprintf(stderr, "*** ftpOpendir(%s)\n", path);
        }
     }
 
-    nb += sizeof(*dir) + sizeof(*dp) + ((ac + 1) * sizeof(*av)) + (ac + 1);
-    dir = xcalloc(1, nb);
+    nb += sizeof(*mydir) + sizeof(*dp) + ((ac + 1) * sizeof(*av)) + (ac + 1);
+    mydir = xcalloc(1, nb);
     /*@-abstract@*/
-    dp = (struct dirent *) (dir + 1);
+    dp = (struct dirent *) (mydir + 1);
     av = (const char **) (dp + 1);
     dt = (char *) (av + (ac + 1));
     t = (char *) (dt + ac + 1);
     /*@=abstract@*/
 
-    dir->fd = ftpmagicdir;
-    dir->data = (char *) dp;
-    dir->allocation = nb;
-    dir->size = ac;
-    dir->offset = -1;
-    dir->filepos = 0;
+    mydir->fd = ftpmagicdir;
+/*@-usereleased@*/
+    mydir->data = (char *) dp;
+/*@=usereleased@*/
+    mydir->allocation = nb;
+    mydir->size = ac;
+    mydir->offset = -1;
+    mydir->filepos = 0;
 
     ac = 0;
     /*@-dependenttrans -unrecog@*/
@@ -1223,15 +1245,18 @@ fprintf(stderr, "*** ftpOpendir(%s)\n", path);
     }
     av[ac] = NULL;
 
-    return dir;
+/*@-kepttrans@*/
+    return (DIR *) mydir;
+/*@=kepttrans@*/
 }
 /*@=boundswrite@*/
 
-/*@null@*/
+/*@dependent@*/ /*@null@*/
 static struct dirent * ftpReaddir(DIR * dir)
        /*@globals fileSystem @*/
        /*@modifies fileSystem @*/
 {
+    FTPDIR mydir = (FTPDIR)dir;
     struct dirent * dp;
     const char ** av;
     unsigned char * dt;
@@ -1239,33 +1264,40 @@ static struct dirent * ftpReaddir(DIR * dir)
     int i;
 
     /*@+voidabstract@*/
-    if (dir == NULL || !ISFTPMAGIC(dir) || dir->data == NULL) {
+    if (mydir == NULL || !ISFTPMAGIC(mydir) || mydir->data == NULL) {
        /* XXX TODO: EBADF errno. */
        return NULL;
     }
     /*@=voidabstract@*/
 
-    dp = (struct dirent *) dir->data;
+    dp = (struct dirent *) mydir->data;
     av = (const char **) (dp + 1);
-    ac = dir->size;
+    ac = mydir->size;
     dt = (char *) (av + (ac + 1));
-    i = dir->offset + 1;
+    i = mydir->offset + 1;
 
+/*@-boundsread@*/
     if (i < 0 || i >= ac || av[i] == NULL)
        return NULL;
+/*@=boundsread@*/
 
-    dir->offset = i;
+    mydir->offset = i;
 
     /* XXX glob(3) uses REAL_DIR_ENTRY(dp) test on d_ino */
     dp->d_ino = i + 1;         /* W2DO? */
-    dp->d_off = 0;             /* W2DO? */
     dp->d_reclen = 0;          /* W2DO? */
+
+#if !defined(hpux) && !defined(sun)
+    dp->d_off = 0;             /* W2DO? */
+/*@-boundsread@*/
     dp->d_type = dt[i];
+/*@=boundsread@*/
+#endif
 
     strncpy(dp->d_name, av[i], sizeof(dp->d_name));
 /*@+voidabstract@*/
 if (_ftp_debug)
-fprintf(stderr, "*** ftpReaddir(%p) %p \"%s\"\n", (void *)dir, dp, dp->d_name);
+fprintf(stderr, "*** ftpReaddir(%p) %p \"%s\"\n", (void *)mydir, dp, dp->d_name);
 /*@=voidabstract@*/
     
     return dp;
@@ -1276,16 +1308,18 @@ static int ftpClosedir(/*@only@*/ DIR * dir)
        /*@globals fileSystem @*/
        /*@modifies dir, fileSystem @*/
 {
+    FTPDIR mydir = (FTPDIR)dir;
+
     /*@+voidabstract@*/
 if (_ftp_debug)
-fprintf(stderr, "*** ftpClosedir(%p)\n", (void *)dir);
-    if (dir == NULL || !ISFTPMAGIC(dir)) {
+fprintf(stderr, "*** ftpClosedir(%p)\n", (void *)mydir);
+    if (mydir == NULL || !ISFTPMAGIC(mydir)) {
        /* XXX TODO: EBADF errno. */
        return -1;
     }
-    free((void *)dir);
+    free((void *)mydir);
     /*@=voidabstract@*/
-    dir = NULL;
+    mydir = NULL;
     return 0;
 }
 
@@ -1359,7 +1393,9 @@ int Readlink(const char * path, char * buf, size_t bufsiz)
        return -2;
        /*@notreached@*/ break;
     }
+/*@-compdef@*/
     return readlink(path, buf, bufsiz);
+/*@=compdef@*/
 }
 
 int Access(const char * path, int amode)