[gnurl] 157/411: ftp: avoid risk of reading uninitialized integers

[gnunet]

This is an automated email from the git hooks/post-receive script.

nikita pushed a commit to branch master
in repository gnurl.

commit 3d8731c8f52cf1ed40bbabd319a3b732cdbcd3d2
Author: Daniel Stenberg <daniel@haxx.se>
AuthorDate: Thu Sep 17 16:16:38 2020 +0200

    ftp: avoid risk of reading uninitialized integers
    
    If the received PASV response doesn't match the expected pattern, we
    could end up reading uninitialized integers for IP address and port
    number.
    
    Issue pointed out by muse.dev
    Closes #5972
---
 lib/ftp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/ftp.c b/lib/ftp.c
index 868a97a53..434401390 100644
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -1860,8 +1860,8 @@ static CURLcode ftp_state_pasv_resp(struct connectdata 
*conn,
   else if((ftpc->count1 == 1) &&
           (ftpcode == 227)) {
     /* positive PASV response */
-    unsigned int ip[4];
-    unsigned int port[2];
+    unsigned int ip[4] = {0, 0, 0, 0};
+    unsigned int port[2] = {0, 0};
 
     /*
      * Scan for a sequence of six comma-separated numbers and use them as

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.