FTP dereferences null pointers

Guy Harris guy at sun.uucp
Thu Sep 26 14:52:07 AEST 1985


Index:	ucb/ftp/main.c 4.2BSD

Description:
	In various circumstances, FTP will dereference null pointers.
Fix:
	Your line numbers may vary.

*** main.c.BAK	Mon Jul 15 16:04:05 1985
--- main.c	Wed Jul 31 16:32:40 1985
***************
*** 35,40
  int	intr();
  int	lostpeer();
  extern	char *home;
  
  main(argc, argv)
  	char *argv[];

--- 35,41 -----
  int	intr();
  int	lostpeer();
  extern	char *home;
+ char	*getlogin();
  
  main(argc, argv)
  	char *argv[];
***************
*** 41,47
  {
  	register char *cp;
  	int top;
! 	struct passwd *pw;
  	char homedir[MAXPATHLEN];
  
  	sp = getservbyname("ftp", "tcp");

--- 42,48 -----
  {
  	register char *cp;
  	int top;
! 	struct passwd *pw = NULL;
  	char homedir[MAXPATHLEN];
  
  	sp = getservbyname("ftp", "tcp");
***************
*** 103,109
  	/*
  	 * Set up the home directory in case we're globbing.
  	 */
! 	pw = getpwnam(getlogin());
  	if (pw == NULL)
  		pw = getpwuid(getuid());
  	if (pw != NULL) {

--- 104,112 -----
  	/*
  	 * Set up the home directory in case we're globbing.
  	 */
! 	cp = getlogin();
! 	if (cp != NULL)
! 		pw = getpwnam(cp);
  	if (pw == NULL)
  		pw = getpwuid(getuid());
  	if (pw != NULL) {
***************
*** 202,207
  		if (line[0] == 0)
  			break;
  		makeargv();
  		c = getcmd(margv[0]);
  		if (c == (struct cmd *)-1) {
  			printf("?Ambiguous command\n");

--- 205,212 -----
  		if (line[0] == 0)
  			break;
  		makeargv();
+ 		if (margc == 0)
+ 			continue;
  		c = getcmd(margv[0]);
  		if (c == (struct cmd *)-1) {
  			printf("?Ambiguous command\n");
***************
*** 400,406
  		for (i = 0; i < lines; i++) {
  			for (j = 0; j < columns; j++) {
  				c = cmdtab + j * lines + i;
! 				printf("%s", c->c_name);
  				if (c + lines >= &cmdtab[NCMDS]) {
  					printf("\n");
  					break;

--- 405,412 -----
  		for (i = 0; i < lines; i++) {
  			for (j = 0; j < columns; j++) {
  				c = cmdtab + j * lines + i;
! 				if (c->c_name)
! 					printf("%s", c->c_name);
  				if (c + lines >= &cmdtab[NCMDS]) {
  					printf("\n");
  					break;

	Guy Harris



More information about the Comp.bugs.4bsd.ucb-fixes mailing list