Synopsis: one-byte overrun in replydirname() in ftpd
NetBSD versions: 1.5
See also: 20001220-ftpd-1.4.3
Thanks to: Kristian Vlaardingerbroek <kris@obit.nl>,
	Jun-ichiro itojun Hagino <itojun@iijlab.net>

Index: libexec/ftpd/cmds.c
===================================================================
RCS file: /cvsroot/basesrc/libexec/ftpd/cmds.c,v
retrieving revision 1.4.2.1
retrieving revision 1.4.2.2
diff -u -u -r1.4.2.1 -r1.4.2.2
--- libexec/ftpd/cmds.c	2000/07/13 01:06:35	1.4.2.1
+++ libexec/ftpd/cmds.c	2000/12/13 21:18:09	1.4.2.2
@@ -787,14 +787,20 @@
 static void
 replydirname(const char *name, const char *message)
 {
+	char *p, *ep;
 	char npath[MAXPATHLEN];
-	int i;
 
-	for (i = 0; *name != '\0' && i < sizeof(npath) - 1; i++, name++) {
-		npath[i] = *name;
-		if (*name == '"')
-			npath[++i] = '"';
+	p = npath;
+	ep = &npath[sizeof(npath) - 1];
+	while (*name) {
+		if (*name == '"' && ep - p >= 2) {
+			*p++ = *name++;
+			*p++ = '"';
+		} else if (ep - p >= 1)
+			*p++ = *name++;
+		else
+			break;
 	}
-	npath[i] = '\0';
+	*p = '\0';
 	reply(257, "\"%s\" %s", npath, message);
 }