xu-wang11 / ftpserver Goto Github PK
View Code? Open in Web Editor NEWC version Ftpserver, run on linux
License: MIT License
C version Ftpserver, run on linux
License: MIT License
hello, I'm just learning ftp protocol
found some bugs here and just make a mark
don't mind ^ ^
int index = _find_first_of(*buf, ' ');
if (index < 0) {
*cmd = _substring(*buf, 0, strlen(*buf) - 2)
the problem just like the first one
what if I send
send('USER anonymous\r\n')
send('PASS\r\n')
then the argument value will be null
when handle_PASS called
strcpy(client->_pass, pass); cause null deference
heap overflow in handle_USER and handle_PASS
struct FtpClient only have name[20] pass[20]
size is fix 20
but it can recv more then 20 bytes
what if
send('USER anonymous\r\n')
send('PASS '+'a'*0x100+'\r\n') # buffer overflow
send('QUIT\r\n')
the will free heap chunk which is overwrote, crash the server
dir fix buf size
if there have a dir size larger than 300 something bad happend
just like
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/
cause stack overflow and heap overflow
Hi,
I'm considering forking your code for FtpServer for use as a very small ftpd that I can use on my laptop.
What type of license are you releasing the software under, or do you consider it to be in the public domain?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.