From patchwork Sat Feb 8 21:18:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marton Balint X-Patchwork-Id: 17727 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 62E1C44B956 for ; Sat, 8 Feb 2020 23:19:28 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5120568B06E; Sat, 8 Feb 2020 23:19:28 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from iq.passwd.hu (iq.passwd.hu [217.27.212.140]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2A23768B083 for ; Sat, 8 Feb 2020 23:19:26 +0200 (EET) Received: from localhost (localhost [127.0.0.1]) by iq.passwd.hu (Postfix) with ESMTP id F0219E3925; Sat, 8 Feb 2020 22:19:25 +0100 (CET) X-Virus-Scanned: amavisd-new at passwd.hu Received: from iq.passwd.hu ([127.0.0.1]) by localhost (iq.passwd.hu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id doCa_0Y_1YEG; Sat, 8 Feb 2020 22:19:24 +0100 (CET) Received: from bluegene.passwd.hu (localhost [127.0.0.1]) by iq.passwd.hu (Postfix) with ESMTP id 3110DE3B91; Sat, 8 Feb 2020 22:19:23 +0100 (CET) From: Marton Balint To: ffmpeg-devel@ffmpeg.org Date: Sat, 8 Feb 2020 22:18:22 +0100 Message-Id: <20200208211823.31345-11-cus@passwd.hu> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20200208211823.31345-1-cus@passwd.hu> References: <20200208211823.31345-1-cus@passwd.hu> Subject: [FFmpeg-devel] [PATCH 11/12] avformat/ftp: do not break protocol on username or password with newlines X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Marton Balint MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Signed-off-by: Marton Balint --- libavformat/ftp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/ftp.c b/libavformat/ftp.c index 860dd7d8dc..ab7368256c 100644 --- a/libavformat/ftp.c +++ b/libavformat/ftp.c @@ -18,6 +18,8 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +#include + #include "libavutil/avstring.h" #include "libavutil/internal.h" #include "libavutil/parseutils.h" @@ -246,10 +248,14 @@ static int ftp_auth(FTPContext *s) static const int user_codes[] = {331, 230, 0}; static const int pass_codes[] = {230, 0}; + if (strpbrk(s->user, "\r\n")) + return AVERROR(EINVAL); snprintf(buf, sizeof(buf), "USER %s\r\n", s->user); err = ftp_send_command(s, buf, user_codes, NULL); if (err == 331) { if (s->password) { + if (strpbrk(s->password, "\r\n")) + return AVERROR(EINVAL); snprintf(buf, sizeof(buf), "PASS %s\r\n", s->password); err = ftp_send_command(s, buf, pass_codes, NULL); } else