<commit_before>/****************************************************************************
 *
 * Copyright 2016 Samsung Electronics All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
 * either express or implied. See the License for the specific
 * language governing permissions and limitations under the License.
 *
 ****************************************************************************/
/****************************************************************************
 * external/ftpc/ftpc_transfer.c
 *
 *   Copyright (C) 2011 <NAME>. All rights reserved.
 *   Author: <NAME> <<EMAIL>>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name NuttX nor the names of its contributors may be
 *    used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 ****************************************************************************/

/****************************************************************************
 * Included Files
 ****************************************************************************/

#include <sys/stat.h>
#include <sys/time.h>

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
#include <poll.h>
#include <ctype.h>
#include <errno.h>
#include <assert.h>
#include <debug.h>

#include <protocols/ftpc.h>

#include "ftpc_internal.h"

/****************************************************************************
 * Pre-processor Definitions
 ****************************************************************************/

/****************************************************************************
 * Private Types
 ****************************************************************************/

/****************************************************************************
 * Private Data
 ****************************************************************************/

/****************************************************************************
 * Public Data
 ****************************************************************************/

/****************************************************************************
 * Private Functions
 ****************************************************************************/

/****************************************************************************
 * Name: ftp_pasvmode
 *
 * Description:
 *   Enter passive mode.
 *
 *   In active mode FTP the client connects from a random port (N>1023) to the
 *   FTP server's command port, port 21. Then, the client starts listening to
 *   port N+1 and sends the FTP command PORT N+1 to the FTP server. The server
 *   will then connect back to the client's specified data port from its local
 *   data port, which is port 20. In passive mode FTP the client initiates
 *   both connections to the server, solving the problem of firewalls filtering
 *   the incoming data port connection to the client from the server. When
 *   opening an FTP connection, the client opens two random ports locally
 *   (N>1023 and N+1). The first port contacts the server on port 21, but
 *   instead of then issuing a PORT command and allowing the server to connect
 *   back to its data port, the client will issue the PASV command. The result
 *   of this is that the server then opens a random unprivileged port (P >
 *   1023) and sends the PORT P command back to the client. The client then
 *   initiates the connection from port N+1 to port P on the server to transfer
 *   data.
 *
 ****************************************************************************/

static int ftp_pasvmode(struct ftpc_session_s *session, uint8_t addrport[6])
{
	int tmpap[6];
	char *ptr;
	int nscan;
	int ret;
	int i;

	/* Does this host support the PASV command */

	if (!FTPC_HAS_PASV(session)) {
		ndbg("Host doesn't support passive mode\n");
		return ERROR;
	}

	/* Request passive mode.  The server normally accepts PASV with code 227.
	 * Its response is a single line showing the IP address of the server and
	 * the TCP port number where the server is accepting connections.
	 */

	ret = ftpc_cmd(session, "PASV");
	if (ret < 0 || !ftpc_connected(session)) {
		return ERROR;
	}

	/* Skip over any leading stuff before address begins */

	ptr = session->reply + 4;
	while (!isdigit((int)*ptr)) {
		ptr++;
	}

	/* The response is then 6 integer values:  four representing the
	 * IP address and two representing the port number.
	 */

	nscan = sscanf(ptr, "%d,%d,%d,%d,%d,%d", &tmpap[0], &tmpap[1], &tmpap[2], &tmpap[3], &tmpap[4], &tmpap[5]);
	if (nscan != 6) {<commit_msg>Fix stack based memory disclosure in FTP client<commit_after>/****************************************************************************
 *
 * Copyright 2016 Samsung Electronics All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
 * either express or implied. See the License for the specific
 * language governing permissions and limitations under the License.
 *
 ****************************************************************************/
/****************************************************************************
 * external/ftpc/ftpc_transfer.c
 *
 *   Copyright (C) 2011 <NAME>. All rights reserved.
 *   Author: <NAME> <<EMAIL>>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name NuttX nor the names of its contributors may be
 *    used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 ****************************************************************************/

/****************************************************************************
 * Included Files
 ****************************************************************************/

#include <sys/stat.h>
#include <sys/time.h>

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
#include <poll.h>
#include <ctype.h>
#include <errno.h>
#include <assert.h>
#include <debug.h>

#include <protocols/ftpc.h>

#include "ftpc_internal.h"

/****************************************************************************
 * Pre-processor Definitions
 ****************************************************************************/

/****************************************************************************
 * Private Types
 ****************************************************************************/

/****************************************************************************
 * Private Data
 ****************************************************************************/

/****************************************************************************
 * Public Data
 ****************************************************************************/

/****************************************************************************
 * Private Functions
 ****************************************************************************/

/****************************************************************************
 * Name: ftp_pasvmode
 *
 * Description:
 *   Enter passive mode.
 *
 *   In active mode FTP the client connects from a random port (N>1023) to the
 *   FTP server's command port, port 21. Then, the client starts listening to
 *   port N+1 and sends the FTP command PORT N+1 to the FTP server. The server
 *   will then connect back to the client's specified data port from its local
 *   data port, which is port 20. In passive mode FTP the client initiates
 *   both connections to the server, solving the problem of firewalls filtering
 *   the incoming data port connection to the client from the server. When
 *   opening an FTP connection, the client opens two random ports locally
 *   (N>1023 and N+1). The first port contacts the server on port 21, but
 *   instead of then issuing a PORT command and allowing the server to connect
 *   back to its data port, the client will issue the PASV command. The result
 *   of this is that the server then opens a random unprivileged port (P >
 *   1023) and sends the PORT P command back to the client. The client then
 *   initiates the connection from port N+1 to port P on the server to transfer
 *   data.
 *
 ****************************************************************************/

static int ftp_pasvmode(struct ftpc_session_s *session, uint8_t addrport[6])
{
	int tmpap[6];
	char *ptr;
	int nscan;
	int ret;
	int i;

	/* Does this host support the PASV command */

	if (!FTPC_HAS_PASV(session)) {
		ndbg("Host doesn't support passive mode\n");
		return ERROR;
	}

	/* Request passive mode.  The server normally accepts PASV with code 227.
	 * Its response is a single line showing the IP address of the server and
	 * the TCP port number where the server is accepting connections.
	 */

	ret = ftpc_cmd(session, "PASV");
	if (ret < 0 || !ftpc_connected(session)) {
		return ERROR;
	}

	/* Skip over any leading stuff before address begins */

	ptr = session->reply + 4;
	while (*ptr && !isdigit((int)*ptr)) {
		ptr++;
	}

	/* The response is then 6 integer values:  four representing the
	 * IP address and two representing the port number.
	 */

	nscan = sscanf(ptr, "%d,%d,%d,%d,%d,%d", &tmpap[0], &tmpap[1], &tmpap[2], &tmpap[3], &tmpap[4], &tmpap[5]);
	if (nscan != 6) {
{'fraction_non_alphanumeric': 0.28271289343345585, 'fraction_numerical': 0.008467806358843265, 'mean_word_length': 4.899622997172479, 'pattern_counts': {'":': 0, '<': 37, '<?xml version=': 0, '>': 43, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1756808', 'n_tokens_mistral': 3169, 'n_tokens_neox': 2789, 'n_words': 1324}