<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Package: proftpd-mod-vroot<br/>
Version: 0.9.2-2+b2<br/>
Severity: grave</div>

<div> </div>

<div>The proftpd module mod_vroot is broken, because the alias string processing is erroneous. The result of the function vroot_lookup_path may look like this without the attached patch:</div>

<div>static int vroot_lstat(pr_fs_t *fs, const char *orig_path, struct stat *st) {<br/>
...</div>

<div>  if (vroot_lookup_path(NULL, vpath, sizeof(vpath)-1, path, 0, NULL) < 0) {<br/>
    destroy_pool(tmp_pool);<br/>
    return -1;<br/>
  }</div>

<div>(void) pr_log_writefile(vroot_logfd, MOD_VROOT_VERSION, "(lstat) ==> path '%s'", path);<br/>
(void) pr_log_writefile(vroot_logfd, MOD_VROOT_VERSION, "(lstat) ==> vpath '%s'", vpath);</div>

<div>  if ((vroot_opts & VROOT_OPT_ALLOW_SYMLINKS) ||<br/>
      vroot_is_alias(path) == 0) {<br/>
...<br/>
)</div>

<div>Aug 22 21:06:18 mod_vroot/0.9.2[8919]: (lstat) ==> path '/folder1/test.sh'<br/>
Aug 22 21:06:18 mod_vroot/0.9.2[8919]: (lstat) ==> vpath '/media/b464f0f6-0ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/ebc-426f-b5cf-4f4324ccf906/folder1/eb</div>

<div>Using the following patch makes the module working. The code changes has been taken from the original GIT repository https://github.com/Castaglia/proftpd-mod_vroot.</div>

<div>--- proftpd-mod-vroot-0.9.2.orig/mod_vroot.c<br/>
+++ proftpd-mod-vroot-0.9.2/mod_vroot.c<br/>
@@ -225,7 +225,7 @@ loop:<br/>
 <br/>
   } else if (*bufp != '\0') {<br/>
     size_t buflen, tmplen;<br/>
-    char *ptr;<br/>
+    char *ptr = NULL;<br/>
 <br/>
     ptr = strstr(bufp, "..");<br/>
     if (ptr != NULL) {<br/>
@@ -280,9 +280,14 @@ loop:<br/>
     if (vroot_aliastab != NULL) {<br/>
       char *start_ptr = NULL, *end_ptr = NULL, *src_path = NULL;<br/>
 <br/>
+      /* buf is used here for storing the "suffix", to be appended later when<br/>
+       * aliases are found.<br/>
+       */<br/>
+      bufp = buf;<br/>
+<br/>
       start_ptr = path;<br/>
       while (start_ptr != NULL) {<br/>
-        char *ptr;<br/>
+        char *ptr = NULL;<br/>
 <br/>
         pr_signals_handle();<br/>
 <br/>
@@ -312,8 +317,8 @@ loop:<br/>
           sstrncpy(path, src_path, pathlen);<br/>
 <br/>
           if (end_ptr != NULL) {<br/>
-            sstrcat(path, "/", pathlen);<br/>
-            sstrcat(path, end_ptr + 1, pathlen);<br/>
+            /* Now tack on our suffix from the scratchpad. */<br/>
+            sstrcat(path, bufp, pathlen);<br/>
           }<br/>
 <br/>
           break;<br/>
@@ -334,6 +339,8 @@ loop:<br/>
           break;<br/>
         }<br/>
 <br/>
+        /* Store the suffix in the buf scratchpad. */<br/>
+        sstrncpy(buf, ptr, sizeof(buf));<br/>
         end_ptr = ptr;<br/>
         *end_ptr = '\0';<br/>
       }</div>
</div></div></body></html>