[SCM] GNU Inetutils branch, master, updated. inetutils-1_9_1-194-ge1c5c58

[Mats Erik Andersson]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU Inetutils ".

The branch, master has been updated
       via  e1c5c5849a6a26e52d32cfd5c9d75d881a9c497f (commit)
      from  cc2173d24f4c905b05c58e61ace0095f0deb1354 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e1c5c5849a6a26e52d32cfd5c9d75d881a9c497f


commit e1c5c5849a6a26e52d32cfd5c9d75d881a9c497f
Author: Mats Erik Andersson <address@hidden>
Date:   Sun Oct 28 11:52:08 2012 +0100

    ftpd: Glob overflow and dereference.

diff --git a/ChangeLog b/ChangeLog
index 2ff9f4c..489f5a4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-10-28  Mats Erik Andersson  <address@hidden>
+
+       * ftpd/popen.c (ftpd_popen): Prevent null deference
+       and allocation overflow in access to glob patterns.
+
 2012-10-23  Mats Erik Andersson  <address@hidden>
 
        ftpd: PAM robustness.  Fine tune message passing,
diff --git a/ftpd/popen.c b/ftpd/popen.c
index 8cc6857..f67d4e2 100644
--- a/ftpd/popen.c
+++ b/ftpd/popen.c
@@ -131,8 +131,8 @@ ftpd_popen (char *program, const char *type)
       memset (&gl, 0, sizeof (gl));
       if (glob (argv[argc], flags, NULL, &gl))
        gargv[gargc++] = strdup (argv[argc]);
-      else
-       for (pop = gl.gl_pathv; *pop; pop++)
+      else if (gl.gl_pathc > 0)
+       for (pop = gl.gl_pathv; *pop && (gargc < MAX_GARGC - 1); pop++)
          gargv[gargc++] = strdup (*pop);
       globfree (&gl);
     }

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog    |    5 +++++
 ftpd/popen.c |    4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GNU Inetutils