Merge branch 'busybox' into merge

1 files changed, 25 insertions, 22 deletions

diff --git a/networking/wget.c b/networking/wget.c
index aaa068ba9..5ff31d278 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -794,12 +794,9 @@ static void spawn_ssl_client(const char *host, int network_fd, int flags)
 static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_sockaddr *lsa)
 {
         FILE *sfp;
-        char *str;
+        char *pass;
         int port;
 
-        if (!target->user)
-                target->user = xstrdup("anonymous:busybox@");
-
         sfp = open_socket(lsa);
 #if ENABLE_FEATURE_WGET_HTTPS
         if (target->protocol == P_FTPS)
@@ -810,18 +807,20 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
                 bb_error_msg_and_die("%s", G.wget_buf);
                 /* note: ftpcmd() sanitizes G.wget_buf, ok to print */
 
-        /*
-         * Splitting username:password pair,
-         * trying to log in
-         */
-        str = strchr(target->user, ':');
-        if (str)
-                *str++ = '\0';
-        switch (ftpcmd("USER ", target->user, sfp)) {
+        /* Split username:password pair */
+        pass = (char*)"busybox"; /* password for "anonymous" */
+        if (target->user) {
+                pass = strchr(target->user, ':');
+                if (pass)
+                        *pass++ = '\0';
+        }
+
+        /* Log in */
+        switch (ftpcmd("USER ", target->user ?: "anonymous", sfp)) {
         case 230:
                 break;
         case 331:
-                if (ftpcmd("PASS ", str, sfp) == 230)
+                if (ftpcmd("PASS ", pass, sfp) == 230)
                         break;
                 /* fall through (failed login) */
         default:
@@ -830,20 +829,16 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
 
         ftpcmd("TYPE I", NULL, sfp);
 
-        /*
-         * Querying file size
-         */
+        /* Query file size */
         if (ftpcmd("SIZE ", target->path, sfp) == 213) {
                 G.content_len = BB_STRTOOFF(G.wget_buf + 4, NULL, 10);
                 if (G.content_len < 0 || errno) {
-                        bb_error_msg_and_die("SIZE value is garbage");
+                        bb_error_msg_and_die("bad SIZE value '%s'", G.wget_buf + 4);
                 }
                 G.got_clen = 1;
         }
 
-        /*
-         * Entering passive mode
-         */
+        /* Enter passive mode */
         if (ENABLE_FEATURE_IPV6 && ftpcmd("EPSV", NULL, sfp) == 229) {
                 /* good */
         } else
@@ -1002,11 +997,19 @@ static void NOINLINE retrieve_file_data(FILE *dfp)
                 if (!G.chunked)
                         break;
 
-                fgets_trim_sanitize(dfp, NULL); /* Eat empty line */
+                /* Each chunk ends with "\r\n" - eat it */
+                fgets_trim_sanitize(dfp, NULL);
  get_clen:
+                /* chunk size format is "HEXNUM[;name[=val]]\r\n" */
                 fgets_trim_sanitize(dfp, NULL);
+                errno = 0;
                 G.content_len = STRTOOFF(G.wget_buf, NULL, 16);
-                /* FIXME: error check? */
+                /*
+                 * Had a bug with inputs like "ffffffff0001f400"
+                 * smashing the heap later. Ensure >= 0.
+                 */
+                if (G.content_len < 0 || errno)
+                        bb_error_msg_and_die("bad chunk length '%s'", G.wget_buf);
                 if (G.content_len == 0)
                         break; /* all done! */
                 G.got_clen = 1;