{"action":"created","issue":{"url":"https://api.github.com/repos/Siim/ftp/issues/1","labels_url":"https://api.github.com/repos/Siim/ftp/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/Siim/ftp/issues/1/comments","events_url":"https://api.github.com/repos/Siim/ftp/issues/1/events","html_url":"https://github.com/Siim/ftp/issues/1","id":102466017,"number":1,"title":"Bug: Buffer Over-read","user":{"login":"jtpereyda","id":244969,"avatar_url":"https://avatars.githubusercontent.com/u/244969?v=3","gravatar_id":"","url":"https://api.github.com/users/jtpereyda","html_url":"https://github.com/jtpereyda","followers_url":"https://api.github.com/users/jtpereyda/followers","following_url":"https://api.github.com/users/jtpereyda/following{/other_user}","gists_url":"https://api.github.com/users/jtpereyda/gists{/gist_id}","starred_url":"https://api.github.com/users/jtpereyda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtpereyda/subscriptions","organizations_url":"https://api.github.com/users/jtpereyda/orgs","repos_url":"https://api.github.com/users/jtpereyda/repos","events_url":"https://api.github.com/users/jtpereyda/events{/privacy}","received_events_url":"https://api.github.com/users/jtpereyda/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-21T21:32:44Z","updated_at":"2015-11-12T16:23:29Z","closed_at":"2015-11-12T16:23:28Z","body":"Bug report: Buffer Over-read\r\nRevision: 31b66c3a7182c9f469b00528fc7fe13d2da5b34a\r\n\r\nA buffer over-read can be caused by sending a message with 1024 or more characters.\r\nThe buffer over-read is seen on the client side. On my system, it prints a superfluous \"220 A very warm welcome!\" message, and stops at that message's null character.\r\n\r\nFrom a glance at the code, this seems to come from server.c:41:\r\n\r\n          while (bytes_read = read(connection,buffer,BSIZE)){\r\n\r\n\r\nand line 47:\r\n\r\n          printf(\"User %s sent command: %s\\n\",(state->username==0)?\"unknown\":state->username,buffer);\r\n\r\n`buffer` is initially filled with `\\0` characters, so the printf works, unless you completely fill the buffer. In that case, there is no null terminator and the printf over-reads `buffer`.\r\n\r\nExample:\r\n````\r\n$ nc 10.202.13.142 8021\r\n220 A very warm welcome!\r\nUSER CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCABC\r\n530 Invalid username\r\n500 Unknown command\r\n````\r\n\r\nOutput on server:\r\n````\r\nUser unknown sent command: USER CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC220 A very warm welcome!\r\n\r\nUser unknown sent command: ABC\r\n````\r\n\r\nResults may vary on other systems. It is not known with certainty what, if any, security threat this bug may pose.\r\n\r\nThis bug was found with the help of the Sulley Fuzzing Framework: https://github.com/OpenRCE/sulley."},"comment":{"url":"https://api.github.com/repos/Siim/ftp/issues/comments/156154713","html_url":"https://github.com/Siim/ftp/issues/1#issuecomment-156154713","issue_url":"https://api.github.com/repos/Siim/ftp/issues/1","id":156154713,"user":{"login":"Siim","id":44247,"avatar_url":"https://avatars.githubusercontent.com/u/44247?v=3","gravatar_id":"","url":"https://api.github.com/users/Siim","html_url":"https://github.com/Siim","followers_url":"https://api.github.com/users/Siim/followers","following_url":"https://api.github.com/users/Siim/following{/other_user}","gists_url":"https://api.github.com/users/Siim/gists{/gist_id}","starred_url":"https://api.github.com/users/Siim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Siim/subscriptions","organizations_url":"https://api.github.com/users/Siim/orgs","repos_url":"https://api.github.com/users/Siim/repos","events_url":"https://api.github.com/users/Siim/events{/privacy}","received_events_url":"https://api.github.com/users/Siim/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T16:23:28Z","updated_at":"2015-11-12T16:23:28Z","body":"Thank you @jtpereyda!"}}