Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!seismo!ut-sally!husc6!cmcl2!brl-adm!adm!Hampton@DOCKMASTER.arpa
From: Hampton@DOCKMASTER.arpa (David R. Hampton)
Newsgroups: comp.unix.wizards
Subject: Minor bug in FTPD
Message-ID: <8239@brl-adm.ARPA>
Date: Thu, 9-Jul-87 15:23:23 EDT
Article-I.D.: brl-adm.8239
Posted: Thu Jul  9 15:23:23 1987
Date-Received: Sun, 12-Jul-87 06:23:49 EDT
Sender: news@brl-adm.ARPA
Lines: 43

Description:
        This bug has the potential to manifest on all Berkeley 4.2
        hosts.  It appears as a FTP client crashing immediately
        after it receives the message:
             "150Opening data connection...".
        The real problem is in the handshaking protocol in the
        dataconn routine of the FTP server daemon.  This routine
        can potentially send two replys to the client, where the
        client only expects one. 

Repeat by:
        We encountered this bug repeatedly by running two FTPs
        simultaneously, each doing batch transfers.  It shouldn't
        matter what the transport mechanism is, since the bug is
        in the FTP daemon.
        
Fix by:
        Fix my moving the 'success' reply to the end of the
        dataconn routine, after both failure checks have been made.
        Here are the diffs:


        
RCS file: RCS/ftpd.c,v
retreiving revision 1.1
diff  -r1.1 ftpd.c
418,420d417
<       reply(150, "Opening data connection for %s (%s,%d)%s.",
<           name, inet_ntoa(data_dest.sin_addr.s_addr),
<           ntohs(data_dest.sin_port), sizebuf);
433a431,433
>       reply(150, "Opening data connection for %s (%s,%d)%s.",
>           name, inet_ntoa(data_dest.sin_addr.s_addr),
>           ntohs(data_dest.sin_port), sizebuf);



---David

+--------------------------------------------------------------+
| David R. Hampton                      Ma Bell:(301) 859-4537 |
| Hampton @ Dockmaster.ARPA                                    |
+--------------------------------------------------------------+