proftpd/patches/proftpd-1.3.0a-ctrls-bug2867.patch

--- src/ctrls.c	2006/10/24 16:13:31	1.14
+++ src/ctrls.c	2006/12/12 16:34:43	1.15
@@ -534,11 +534,20 @@
     return -1;
   }
 
+  if (reqarglen >= sizeof(reqaction)) {
+    pr_signals_unblock();
+    errno = ENOMEM;
+    return -1;
+  }
+
+  memset(reqaction, '\0', sizeof(reqaction));
+
   if (read(cl->cl_fd, reqaction, reqarglen) < 0) {
     pr_signals_unblock();
     return -1;
   }
 
+  reqaction[sizeof(reqaction)-1] = '\0';
   nreqargs--;
 
   /* Find a matching action object, and use it to populate a ctrl object,
@@ -657,17 +666,16 @@
       return -1;
     }
 
-    memset(response, '\0', sizeof(response));
-
     /* Make sure resparglen is not too big */
-    if (resparglen > sizeof(response)) {
+    if (resparglen >= sizeof(response)) {
       pr_signals_unblock();
       errno = ENOMEM;
       return -1;
     }
 
-    bread = read(ctrls_sockfd, response, resparglen);
+    memset(response, '\0', sizeof(response));
 
+    bread = read(ctrls_sockfd, response, resparglen);
     while (bread != resparglen) {
       if (bread < 0) {
         pr_signals_unblock(); 
1	--- src/ctrls.c 2006/10/24 16:13:31 1.14
2	+++ src/ctrls.c 2006/12/12 16:34:43 1.15
3	@@ -534,11 +534,20 @@
4	return -1;
5	}
6
7	+ if (reqarglen >= sizeof(reqaction)) {
8	+ pr_signals_unblock();
9	+ errno = ENOMEM;
10	+ return -1;
11	+ }
12	+
13	+ memset(reqaction, '\0', sizeof(reqaction));
14	+
15	if (read(cl->cl_fd, reqaction, reqarglen) < 0) {
16	pr_signals_unblock();
17	return -1;
18	}
19
20	+ reqaction[sizeof(reqaction)-1] = '\0';
21	nreqargs--;
22
23	/* Find a matching action object, and use it to populate a ctrl object,
24	@@ -657,17 +666,16 @@
25	return -1;
26	}
27
28	- memset(response, '\0', sizeof(response));
29	-
30	/* Make sure resparglen is not too big */
31	- if (resparglen > sizeof(response)) {
32	+ if (resparglen >= sizeof(response)) {
33	pr_signals_unblock();
34	errno = ENOMEM;
35	return -1;
36	}
37
38	- bread = read(ctrls_sockfd, response, resparglen);
39	+ memset(response, '\0', sizeof(response));
40
41	+ bread = read(ctrls_sockfd, response, resparglen);
42	while (bread != resparglen) {
43	if (bread < 0) {
44	pr_signals_unblock();