Deny the SIZE command on large files when in ASCII mode.

This eliminates an opportunity for DoS attack.

Pointed out by:	maxim
Inspired by:	lukemftpd, OpenBSD
MFC after:	2 weeks

1 files changed, 6 insertions, 0 deletions

diff --git a/libexec/ftpd/ftpcmd.y b/libexec/ftpd/ftpcmd.y
index 2ddbf75..d7ffc73 100644
--- a/libexec/ftpd/ftpcmd.y
+++ b/libexec/ftpd/ftpcmd.y
@@ -1068,6 +1068,8 @@ check_login_ro
 
 #define	MAXGLOBARGS	1000
 
+#define	MAXASIZE	10240	/* Deny ASCII SIZE on files larger than that */
+
 struct tab {
 	char	*name;
 	short	token;
@@ -1589,6 +1591,10 @@ sizecmd(char *filename)
 			reply(550, "%s: not a plain file.", filename);
 			(void) fclose(fin);
 			return;
+		} else if (stbuf.st_size > MAXASIZE) {
+			reply(550, "%s: too large for type A SIZE.", filename);
+			(void) fclose(fin);
+			return;
 		}
 
 		count = 0;