2 files changed, 35 insertions, 7 deletions

diff --git a/networking/ftpd.c b/networking/ftpd.c
index 7735b7233..8345ae67c 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -1223,11 +1223,26 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
 #endif
         argv += optind;
         if (argv[0]) {
+                const char *basedir = argv[0];
 #if !BB_MMU
                 G.root_fd = xopen("/", O_RDONLY | O_DIRECTORY);
                 close_on_exec_on(G.root_fd);
 #endif
-                xchroot(argv[0]);
+                if (chroot(basedir) == 0)
+                        basedir = "/";
+#if !BB_MMU
+                else {
+                        close(G.root_fd);
+                        G.root_fd = -1;
+                }
+#endif
+                /*
+                 * If chroot failed, assume that we aren't root,
+                 * and at least chdir to the specified DIR
+                 * (older versions were dying with error message).
+                 * If chroot worked, move current dir to new "/":
+                 */
+                xchdir(basedir);
         }
 
 #if ENABLE_FEATURE_FTP_AUTHENTICATION
diff --git a/networking/httpd.c b/networking/httpd.c
index 00169c36d..ed15fd883 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -967,19 +967,30 @@ static void send_headers(int responseNum)
         }
 #endif
         if (responseNum == HTTP_MOVED_TEMPORARILY) {
-                len += sprintf(iobuf + len, "Location: %s/%s%s\r\n",
+                /* Responding to "GET /dir" with
+                 * "HTTP/1.0 302 Found" "Location: /dir/"
+                 * - IOW, asking them to repeat with a slash.
+                 * Here, overflow IS possible, can't use sprintf:
+                 * mkdir test
+                 * python -c 'print("get /test?" + ("x" * 8192))' | busybox httpd -i -h .
+                 */
+                len += snprintf(iobuf + len, IOBUF_SIZE-3 - len,
+                                "Location: %s/%s%s\r\n",
                                 found_moved_temporarily,
                                 (g_query ? "?" : ""),
                                 (g_query ? g_query : ""));
+                if (len > IOBUF_SIZE-3)
+                        len = IOBUF_SIZE-3;
         }
 
 #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
         if (error_page && access(error_page, R_OK) == 0) {
-                strcat(iobuf, "\r\n");
-                len += 2;
-
-                if (DEBUG)
+                iobuf[len++] = '\r';
+                iobuf[len++] = '\n';
+                if (DEBUG) {
+                        iobuf[len] = '\0';
                         fprintf(stderr, "headers: '%s'\n", iobuf);
+                }
                 full_write(STDOUT_FILENO, iobuf, len);
                 if (DEBUG)
                         fprintf(stderr, "writing error page: '%s'\n", error_page);
@@ -1021,8 +1032,10 @@ static void send_headers(int responseNum)
                                 responseNum, responseString,
                                 responseNum, responseString, infoString);
         }
-        if (DEBUG)
+        if (DEBUG) {
+                iobuf[len] = '\0';
                 fprintf(stderr, "headers: '%s'\n", iobuf);
+        }
         if (full_write(STDOUT_FILENO, iobuf, len) != len) {
                 if (verbose > 1)
                         bb_perror_msg("error");