Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Path: utzoo!mnetor!uunet!seismo!ut-sally!husc6!cmcl2!brl-adm!adm!Hampton@DOCKMASTER.arpa From: Hampton@DOCKMASTER.arpa (David R. Hampton) Newsgroups: comp.unix.wizards Subject: Minor bug in FTPD Message-ID: <8239@brl-adm.ARPA> Date: Thu, 9-Jul-87 15:23:23 EDT Article-I.D.: brl-adm.8239 Posted: Thu Jul 9 15:23:23 1987 Date-Received: Sun, 12-Jul-87 06:23:49 EDT Sender: news@brl-adm.ARPA Lines: 43 Description: This bug has the potential to manifest on all Berkeley 4.2 hosts. It appears as a FTP client crashing immediately after it receives the message: "150Opening data connection...". The real problem is in the handshaking protocol in the dataconn routine of the FTP server daemon. This routine can potentially send two replys to the client, where the client only expects one. Repeat by: We encountered this bug repeatedly by running two FTPs simultaneously, each doing batch transfers. It shouldn't matter what the transport mechanism is, since the bug is in the FTP daemon. Fix by: Fix my moving the 'success' reply to the end of the dataconn routine, after both failure checks have been made. Here are the diffs: RCS file: RCS/ftpd.c,v retreiving revision 1.1 diff -r1.1 ftpd.c 418,420d417 < reply(150, "Opening data connection for %s (%s,%d)%s.", < name, inet_ntoa(data_dest.sin_addr.s_addr), < ntohs(data_dest.sin_port), sizebuf); 433a431,433 > reply(150, "Opening data connection for %s (%s,%d)%s.", > name, inet_ntoa(data_dest.sin_addr.s_addr), > ntohs(data_dest.sin_port), sizebuf); ---David +--------------------------------------------------------------+ | David R. Hampton Ma Bell:(301) 859-4537 | | Hampton @ Dockmaster.ARPA | +--------------------------------------------------------------+