Skip to content

FTP: More EPLF 'm' timestamp parsing fixes #2207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MegaManSec wants to merge 13 commits into
base: master
Choose a base branch
from
Open

FTP: More EPLF 'm' timestamp parsing fixes #2207

Changes from 3 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
7cd8319
FtpGateway: Fix reversed check return value check of strtol
MegaManSec Sep 7, 2025
819b0d4
FtpGateway: add further protections
MegaManSec Sep 7, 2025
04a1cc9
fixup hoisting
MegaManSec Sep 7, 2025
df31cb3
recommendations
MegaManSec Sep 8, 2025
be035f9
first suggestion
MegaManSec Oct 20, 2025
3f2ac8d
second suggestion
MegaManSec Oct 20, 2025
ff1423f
third suggestion
MegaManSec Oct 20, 2025
45114b1
typo
MegaManSec Oct 20, 2025
b482b91
polishing
MegaManSec Oct 20, 2025
4a3d382
Update src/clients/FtpGateway.cc
MegaManSec Oct 31, 2025
96e95be
Make ftpListParseParts more strict
MegaManSec Oct 31, 2025
3f54a46
fix typo
MegaManSec Oct 31, 2025
6166a27
fixup: AAA and polished "rejection" comments
rousskov Oct 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions src/clients/FtpGateway.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -687,6 +687,7 @@ ftpListParseParts(const char *buf, struct Ftp::GatewayFlags flags)

while (ct && *ct) {
time_t tm;
const char* cts = nullptr;
int l = strcspn(ct, ",");
char *tmp;

Expand All @@ -707,13 +708,16 @@ ftpListParseParts(const char *buf, struct Ftp::GatewayFlags flags)
case 'm':
tm = (time_t) strtol(ct + 1, &tmp, 0);

if (tmp != ct + 1)
if (tmp == ct + 1)
break; /* not a valid integer */

cts = ctime(&tm);
if (!cts)
break;

safe_free(p->date); // TODO: properly handle multiple p->name occurrences
p->date = xstrdup(ctime(&tm));

*(strstr(p->date, "\n")) = '\0';
p->date = xstrndup(cts, strcspn(cts, "\n"));

break;

Expand Down