ftpd-BSD-overflow.patch

   1 --- libexec/ftpd/ftpd.c 2000/09/15 07:13:45     1.79
   2 +++ libexec/ftpd/ftpd.c 2000/12/05 17:06:29
   3 @@ -1959,15 +1959,21 @@
   4  replydirname(name, message)
   5         const char *name, *message;
   6  {
   7 +       char *p, *ep;
   8         char npath[MAXPATHLEN];
   9 -       int i;
  10
  11 -       for (i = 0; *name != '\0' && i < sizeof(npath) - 1; i++, name++) {
  12 -               npath[i] = *name;
  13 -               if (*name == '"')
  14 -                       npath[++i] = '"';
  15 +       p = npath;
  16 +       ep = &npath[sizeof(npath) - 1];
  17 +       while (*name) {
  18 +               if (*name == '"' && ep - p >= 2) {
  19 +                       *p++ = *name++;
  20 +                       *p++ = '"';
  21 +               } else if (ep - p >= 1)
  22 +                       *p++ = *name++;
  23 +               else
  24 +                       break;
  25         }
  26 -       npath[i] = '\0';
  27 +       *p = '\0';
  28         reply(257, "\"%s\" %s", npath, message);
  29  }
  30