CVE-2019-20176: Uncontrolled Resource Consumption (CWE-400)
value: In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2019-12-31T15:15Z
Repository: https://github.com/jedisct1/pure-ftpd
Language: C
Files changed: src/ls.c
Commit date: 2019-12-30 17:40:04 +0100
Commit message: listdir(): reuse a single buffer to store every file name to display

Allocating a new buffer for each entry is useless.

And as these buffers are allocated on the stack, on systems with a
small stack size, with many entries, the limit can easily be reached,
causing a stack exhaustion and aborting the user session.

Reported by Antonio Morales from the GitHub Security Lab team, thanks!

Diff: diff --git a/src/ls.c b/src/ls.c
index cf804c7..f8a588f 100644
--- a/src/ls.c
+++ b/src/ls.c
@@ -659,10 +659,12 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
 {
     PureFileInfo *dir;
     char *names;
     PureFileInfo *s;
     PureFileInfo *r;
+    char *alloca_subdir;
+    size_t sizeof_subdir;
     int d;
 
     if (depth >= max_ls_depth || matches >= max_ls_files) {
         return;
     }
@@ -688,28 +690,26 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
         }
         s++;
     }
     outputfiles(f, tls_fd);
     r = dir;
+    sizeof_subdir = PATH_MAX + 1U;
+    if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
+        goto toomany;
+    }
     while (opt_R && r != s) {
         if (r->name_offset != (size_t) -1 && !chdir(FI_NAME(r))) {
-            char *alloca_subdir;
-            const size_t sizeof_subdir = PATH_MAX + 1U;
-
-            if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
-                goto toomany;
-            }
             if (SNCHECK(snprintf(alloca_subdir, sizeof_subdir, "%s/%s",
                                  name, FI_NAME(r)), sizeof_subdir)) {
                 goto nolist;
             }
             wrstr(f, tls_fd, "\r\n\r\n");
             wrstr(f, tls_fd, alloca_subdir);
             wrstr(f, tls_fd, ":\r\n\r\n");
             listdir(depth + 1U, f, tls_fd, alloca_subdir);
+
             nolist:
-            ALLOCA_FREE(alloca_subdir);
             if (matches >= max_ls_files) {
                 goto toomany;
             }
             if (chdir("..")) {    /* defensive in the extreme... */
                 if (chdir(wd) || chdir(name)) {    /* someone rmdir()'d it? */
@@ -718,10 +718,11 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
             }
         }
         r++;
     }
     toomany:
+    ALLOCA_FREE(alloca_subdir);
     free(names);
     free(dir);
     names = NULL;
 }
 

Vulnerable code:             char *alloca_subdir;
            const size_t sizeof_subdir = PATH_MAX + 1U;

            if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
                goto toomany;
            }
            ALLOCA_FREE(alloca_subdir);
Fixed code:     char *alloca_subdir;
    size_t sizeof_subdir;
    sizeof_subdir = PATH_MAX + 1U;
    if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
        goto toomany;
    }

    ALLOCA_FREE(alloca_subdir);