[patch] Segmentation fault when using lftp on web pages

[Martin Nagy]

Hi. lftp 3.6.1 will core dump when used on a page that uses empty 
arguments for tags, eg. '<meta content="">'. To reproduce, put attached 
index.html on a web server, then:
$ lftp http://localhost/
cd ok, cwd=/
lftp localhost:/> ls
Segmentation fault
Exit 139

The attached patch fixes the problem, but maybe you'll be able to come 
up with a better one.

Regards,
Martin Nagy





<fig src="">
<overlay src="">



<bgsound src="">
<area href="">
<img lowsrc="">


<table background="">
<th background="">
<td background="">




</td></tr></table><pre>diff -up lftp-3.6.1/src/HttpDir.cc.empty_content lftp-3.6.1/src/HttpDir.cc
--- lftp-3.6.1/src/HttpDir.cc.empty_content	2007-08-29 13:20:13.000000000 +0200
+++ lftp-3.6.1/src/HttpDir.cc	2008-01-24 14:56:02.000000000 +0100
@@ -729,6 +729,8 @@ static int parse_html(const char *buf,in
       // skip 0; URL=
       link_target.rtrim();
       const char *scan=link_target;
+      if(!scan)
+	 return tag_len;
       while(*scan &amp;&amp; is_ascii_digit(*scan))
 	 scan++;
       if(*scan!=';')
@@ -763,7 +765,7 @@ static int parse_html(const char *buf,in
       a_href=true;
 
    // check if the target is a relative and not a cgi
-   if(strchr(link_target,'?'))
+   if(!link_target||strchr(link_target,'?'))
       return tag_len;	// cgi
    link_target.truncate_at('#'); // strip the anchor
    if(link_target.length()==0)
</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
</div> <!-- end of msgBody class --></pre><script type="text/javascript"><!--
google_ad_client = "ca-pub-7266757337600734";
/* Top of Content Medium Box */
google_ad_slot = "9759909619";
google_ad_width = 300;
google_ad_height = 250;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script><pre>

<!--htdig_noindex-->

<div id="adbox">
<script type="text/javascript"><!--
google_ad_client = "ca-pub-7266757337600734";
/* Side Skyscraper */
google_ad_slot = "6234696194";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>


</div>

<div class="tSliceList">
<ul>
<li>
<div class="tSliceCur">
<span class="subject">[patch] Segmentation fault when using lftp on web pages</span>
<span class="sender">Martin Nagy</span>
</div> <!-- end of tSliceCur class -->
<ul>
<li>
<span class="subject"><a name="01651" href="msg01651.html">Re: [patch] Segmentation fault when using lftp on web pages</a></span>
<span class="sender">Martin Nagy</span>
<!-- noop -->
</ul>
</li>
</ul>

</div> <!-- end of tSliceList class -->
<!--/htdig_noindex-->
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<!--htdig_noindex-->
  <ul id="botLinks">
  <li><div class="reply">
<FORM METHOD="POST" ACTION="/mailto.php">


<INPUT TYPE="HIDDEN" NAME="subject" VALUE="[patch] Segmentation fault when using lftp on web pages">
<INPUT TYPE="HIDDEN" NAME="msgid" VALUE="4798A01D.7060300@redhat.com">
Reply via email to<br>
<INPUT TYPE="SUBMIT" VALUE=" Martin Nagy ">
</FORM>
</div>
  </li>
  </ul>
<!--/htdig_noindex-->

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</div> <!-- end of msgcontent class -->
</div> <!-- end of msgcontainer2 class -->

<!-- These extra divs/spans may be used as catch-alls to add extra imagery. -->
<div id="extraDiv1"><span></span></div><div id="extraDiv2"><span></span></div><div id="extraDiv3"><span></span></div>
<div id="extraDiv4"><span></span></div><div id="extraDiv5"><span></span></div><div id="extraDiv6"><span></span></div>

<script type="text/javascript">
  (function() {
    var po = document.createElement('script'); po.type = 'text/javascript'; po.async = true;
    po.src = 'https://apis.google.com/js/plusone.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(po, s);
  })();
</script>
</body>
</html>