diff options
| author | Yaroslav Tykhiy <ytykhiy@gmail.com> | 2002-07-31 10:55:31 +0000 |
|---|---|---|
| committer | Yaroslav Tykhiy <ytykhiy@gmail.com> | 2002-07-31 10:55:31 +0000 |
| commit | 781cfb93488059a19b3090b5d5a723e46b97967f (patch) | |
| tree | 43c6579306afeeb06db9f56163775a4c58c1d242 /libexec/ftpd/ftpcmd.y | |
| parent | 5e33115f056783c6bf2a457c7cd893998bcda431 (diff) | |
| download | src-781cfb93488059a19b3090b5d5a723e46b97967f.tar.gz src-781cfb93488059a19b3090b5d5a723e46b97967f.zip | |
Deny the SIZE command on large files when in ASCII mode.
This eliminates an opportunity for DoS attack.
Pointed out by: maxim
Inspired by: lukemftpd, OpenBSD
MFC after: 2 weeks
Notes
Notes:
svn path=/head/; revision=101034
Diffstat (limited to 'libexec/ftpd/ftpcmd.y')
| -rw-r--r-- | libexec/ftpd/ftpcmd.y | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libexec/ftpd/ftpcmd.y b/libexec/ftpd/ftpcmd.y index 2ddbf75cd056..d7ffc73ff6c0 100644 --- a/libexec/ftpd/ftpcmd.y +++ b/libexec/ftpd/ftpcmd.y @@ -1068,6 +1068,8 @@ check_login_ro #define MAXGLOBARGS 1000 +#define MAXASIZE 10240 /* Deny ASCII SIZE on files larger than that */ + struct tab { char *name; short token; @@ -1589,6 +1591,10 @@ sizecmd(char *filename) reply(550, "%s: not a plain file.", filename); (void) fclose(fin); return; + } else if (stbuf.st_size > MAXASIZE) { + reply(550, "%s: too large for type A SIZE.", filename); + (void) fclose(fin); + return; } count = 0; |