OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: ftpd: the advisory version
From: Bernd Luevelsmeyer (bernd.luevelsmeyerHEITEC.NET)
Date: Sun Jun 25 2000 - 02:43:19 CDT

Lamagra Argamal wrote:
[...]
> There are some other bugs in site_exec like
> for (t = cmd; *t && !isspace(*t); t++) {
> if (isupper(*t)) {
> *t = tolower(*t);
> }
> }
>
> Sanitizing stops at a space?? (good thing I didn't tell you this, eh tf8)
[...]

According to the C standard, <ctype.h> functions operate on values that
are representable as a 'unsigned char' or EOF; hence, if the compiler's
'char' is signed then negative character values in the string 'cmd' are
possible and might cause unpredictable results in isspace(), isupper()
and tolower(). Because sanitizing shouldn't stop, and the test with
isupper() is unnecessary anyway (tolower() returns the unchanged value
if the parameter isn't an uppercase letter), I suggest:
     for (t = cmd; *t; t++)
             *t = tolower((unsigned char)*t);