#include "msgbase.h"
#include "citserver.h"
#include "threads.h"
-
-#ifndef HAVE_SNPRINTF
-#include "snprintf.h"
-#endif
-
#include "ctdl_module.h"
#include "user_ops.h"
ERROR + FILE_NOT_FOUND);
return;
}
+ if (strstr(filename, "../") != NULL)
+ {
+ cprintf("%d syntax error.\n",
+ ERROR + ILLEGAL_VALUE);
+ return;
+ }
if (CC->download_fp != NULL) {
cprintf("%d You already have a download file open.\n",
filename[a] = '_';
}
}
+ if (strstr(filename, "../") != NULL)
+ {
+ cprintf("%d syntax error.\n",
+ ERROR + ILLEGAL_VALUE);
+ return;
+ }
+
snprintf(pathname, sizeof pathname,
"%s/%s",
ctdl_image_dir,
long start_pos;
size_t bytes;
char buf[SIZ];
+ int rc;
/* The client will transmit its requested offset and byte count */
start_pos = extract_long(cmdbuf, 0);
bytes = extract_int(cmdbuf, 1);
+ if ((start_pos < 0) || (bytes <= 0)) {
+ cprintf("%d you have to specify a value > 0.\n", ERROR + ILLEGAL_VALUE);
+ return;
+ }
if (CC->download_fp == NULL) {
cprintf("%d You don't have a download file open.\n",
bytes = sizeof(buf);
}
- fseek(CC->download_fp, start_pos, 0);
+ rc = fseek(CC->download_fp, start_pos, 0);
+ if (rc < 0) {
+ cprintf("%d your file is smaller then %ld.\n", ERROR + ILLEGAL_VALUE, start_pos);
+ syslog(LOG_ALERT, "your file %s is smaller then %ld. [%s]\n",
+ CC->upl_path,
+ start_pos,
+ strerror(errno));
+
+ return;
+ }
bytes = fread(buf, 1, bytes, CC->download_fp);
if (bytes > 0) {
/* Tell the client the actual byte count and transmit it */