Ticket History #5940: when the 'case' option is enabled, mget can miscompute the destination filename

From krb5-bugs-incoming-bounces@PCH.MIT.EDU Thu Apr 17 22:11:57 2008
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
id m3I2BuHW029393; Thu, 17 Apr 2008 22:11:57 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m3I2Bpxg024194;
Thu, 17 Apr 2008 22:11:51 -0400
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
[18.7.21.83])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m3GIhMkA008723
for <krb5-bugs-incoming@PCH.mit.edu>; Wed, 16 Apr 2008 14:43:22 -0400
Received: from mit.edu (W92-130-BARRACUDA-1.MIT.EDU [18.7.21.220])
by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
m3GIhBS6000868
for <krb5-bugs@mit.edu>; Wed, 16 Apr 2008 14:43:12 -0400 (EDT)
Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
by mit.edu (Spam Firewall) with ESMTP id EC13986F0FB
for <krb5-bugs@mit.edu>; Wed, 16 Apr 2008 14:42:50 -0400 (EDT)
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com
[172.16.52.254])
by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id m3GIgonn011902
for <krb5-bugs@mit.edu>; Wed, 16 Apr 2008 14:42:50 -0400
Received: from blade.boston.redhat.com (blade.boston.redhat.com [172.16.80.50])
by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m3GIgn5x026591
for <krb5-bugs@mit.edu>; Wed, 16 Apr 2008 14:42:49 -0400
Received: from blade.boston.redhat.com (localhost.localdomain [127.0.0.1])
by blade.boston.redhat.com (8.14.2/8.14.2) with ESMTP id m3GIgn8G031314
for <krb5-bugs@mit.edu>; Wed, 16 Apr 2008 14:42:49 -0400
Received: (from nalin@localhost)
by blade.boston.redhat.com (8.14.2/8.14.2/Submit) id m3GIgn2s031312;
Wed, 16 Apr 2008 14:42:49 -0400
Date: Wed, 16 Apr 2008 14:42:49 -0400
Message-Id: <200804161842.m3GIgn2s031312@blade.boston.redhat.com>
To: krb5-bugs@mit.edu
Subject: ftp client doesn't always get filenames right during mget with 'case'
enabled
From: nalin@redhat.com
X-send-pr-version: 3.99
X-Scanned-By: MIMEDefang 2.42
X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254
X-Spam-Score: 0.67
X-Spam-Flag: NO
X-Mailman-Approved-At: Thu, 17 Apr 2008 22:11:50 -0400
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: nalin@redhat.com
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU



System: Linux blade.boston.redhat.com 2.6.23-6.fc8 #1 SMP Thu Oct 11 13:36:39 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux
Architecture: x86_64

While processing an "mget" command with case mapping enabled,
the client can attempt to store a file's data in the wrong
local file.
In cases where the client determines that the local file's name
doesn't need to be changed from the remote name, the client has
been setting the target filename pointer to the buffer in which
it would store the lower-cased version of the name, even if it
ended up not generating a lower-cased version of the name,
causing the incoming data to be stored in whichever file whose
name was last generated. (This is in our bug tracking system at
http://bugzilla.redhat.com/442713.)
Create files in a directory with these names:
Test1.out1
TEST2.OUT2
tesT3.Out3
TEST4.OUT4
Connect with a client, turning prompting off, case mapping on,
and use an mget command with a glob to retrieve all of the
files ("mget *"). Absent any specific locale information, the
order of files sent to the client will be this:
TEST2.OUT2
TEST4.OUT4
Test1.out1
tesT3.Out3
The client will store the contents of the first file in a local
file named "test2.out2", and the contents of the last three
files in a local file named "test4.out4".
This patch differs a bit from the one attached to the bug report
mentioned above, but it has a similar effect.

diff -up src/appl/gssftp/ftp/cmds.c src/appl/gssftp/ftp/cmds.c
--- src/appl/gssftp/ftp/cmds.c 2008-04-16 10:36:13.000000000 -0400
+++ src/appl/gssftp/ftp/cmds.c 2008-04-16 10:36:16.000000000 -0400
@@ -1013,8 +1013,10 @@ void mget(argc, argv)
tp++;
tp2++;
}
+ tp = tmpbuf;
+ } else {
+ tp = cp;
}
- tp = tmpbuf;
}
if (ntflag) {
tp = dotrans(tp);

From krb5-bugs-incoming-bounces@PCH.MIT.EDU Mon May 12 15:33:04 2008
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
id m4CJX2HW002428; Mon, 12 May 2008 15:33:02 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m4CJWv85027421;
Mon, 12 May 2008 15:32:57 -0400
Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU
[18.7.7.76])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m4CIJ697007560
for <krb5-bugs-incoming@PCH.mit.edu>; Mon, 12 May 2008 14:19:06 -0400
Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112])
by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id
m4CIIwma028347
for <krb5-bugs@mit.edu>; Mon, 12 May 2008 14:18:59 -0400 (EDT)
X-ASG-Whitelist: Barracuda Reputation
Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
by mit.edu (Spam Firewall) with ESMTP id B8D9810F00EC
for <krb5-bugs@mit.edu>; Mon, 12 May 2008 14:18:58 -0400 (EDT)
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com
[172.16.52.254])
by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id m4CIIwKi028453
for <krb5-bugs@mit.edu>; Mon, 12 May 2008 14:18:58 -0400
Received: from blade.bos.redhat.com (blade.bos.redhat.com [10.16.0.23])
by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m4CIIvK8012101
for <krb5-bugs@mit.edu>; Mon, 12 May 2008 14:18:57 -0400
Received: from blade.bos.redhat.com (localhost.localdomain [127.0.0.1])
by blade.bos.redhat.com (8.14.2/8.14.2) with ESMTP id m4CIIvaG027328
for <krb5-bugs@mit.edu>; Mon, 12 May 2008 14:18:57 -0400
Received: (from nalin@localhost)
by blade.bos.redhat.com (8.14.2/8.14.2/Submit) id m4CIIv9S027326;
Mon, 12 May 2008 14:18:57 -0400
Date: Mon, 12 May 2008 14:18:57 -0400
Message-Id: <200805121818.m4CIIv9S027326@blade.bos.redhat.com>
To: krb5-bugs@mit.edu
From: nalin@redhat.com
X-send-pr-version: 3.99
X-Scanned-By: MIMEDefang 2.42
X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254
X-Spam-Score: 6.278
X-Spam-Level: ****** (6.278)
X-Spam-Flag: NO
X-Mailman-Approved-At: Mon, 12 May 2008 15:32:56 -0400
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: nalin@redhat.com
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU



System: Linux blade.bos.redhat.com 2.6.25-14.fc9.x86_64 #1 SMP Thu May 1 06:06:21 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux
Architecture: x86_64

When "case" is enabled, the FTP client sets the local (target) filename
to the buffer in which it stores the generated lower-cased version of
the file's name, even it ended up not generating a lower-cased version
of the name, causing the client to store the incoming data in whichever
file whose name it had last generated.

Create these files in a space you can get to using the FTP client:
Test1.out1
TEST2.OUT2
tesT3.Out3
TEST4.OUT4
Now ftp in, switch on case-mapping (with the "case" command), and
attempt to retrieve the three files using "mget". You may end up with
files named "test2.out2" and "test4.out4", if the server sends them in
this order:
(remote) (local)
TEST2.OUT2 -> test2.out2
TEST4.OUT4 -> test4.out4
Test1.out1 -> test4.out4
tesT3.Out3 -> test4.out4

This patch fixes it for me:

diff -up src/appl/gssftp/ftp/cmds.c src/appl/gssftp/ftp/cmds.c
--- src/appl/gssftp/ftp/cmds.c
+++ src/appl/gssftp/ftp/cmds.c
@@ -1013,8 +1013,10 @@ void mget(argc, argv)
tp++;
tp2++;
}
+ tp = tmpbuf;
+ } else {
+ tp = cp;
}
- tp = tmpbuf;
}
if (ntflag) {
tp = dotrans(tp);

Aaargh. Please close this as a duplicate of #5940, which I missed when
I was searching to check whether or not I'd already reported this bug.

Sorry for any confusion,

Nalin