Re: cvs: php4 /ext/ftp ftp.c ftp.h php_ftp.c php_ftp.h

From:	Andi Gutmans	Date:	Mon, 27 Jan 2003 05:19:03 +0000
Subject:	Re: cvs: php4 /ext/ftp ftp.c ftp.h php_ftp.c php_ftp.h
References:	1	Groups:	php.cvs
Request:	Send a blank email to php-cvs+get-18192@lists.php.net to get a copy of this message

This is a wonderful opportunity for a buffer overflow attack. There's a reason zend_parse_parameters() in PHP_FUNCTION(ftp_chmod) forces you to retrieve filename_len. Please fix it. Thanks, Andi At 02:54 AM 1/27/2003 +0000, Sara Golemon wrote:

+ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename) +{
+       char buffer[1024];
+
+       if (ftp == NULL) {
+               return 0;
+       }
+
+       sprintf(buffer, "CHMOD %o %s", mode, filename);