Skip to content

Commit add294d

Browse files
committed
Fix potential nil in last_filename
Replacing rapid7#2060. It is possible to get a nil in last_filename if the sub! function doesn't find any 0x00s to replace, so instead it's best to use sub(), which should at least return the original filename. To make sure we don't hit any other unknown conditions that may result in nil last_filename, it's also convert with to_s to make sure it's always a string.
1 parent 8d7396d commit add294d

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/rex/proto/smb/client.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1881,7 +1881,7 @@ def find_first(path)
18811881
'C'+ # Short File Name Length
18821882
'C' # Reserved
18831883
)
1884-
name = resp_data[didx + 70 + 24, info[15]].sub!(/\x00+$/, '')
1884+
name = resp_data[didx + 70 + 24, info[15]].sub(/\x00+$/, '')
18851885
files[name] =
18861886
{
18871887
'type' => ((info[14] & 0x10)==0x10) ? 'D' : 'F',
@@ -1916,7 +1916,7 @@ def find_next(sid, resume_key, last_filename)
19161916
260, # Level of interest
19171917
resume_key, # Resume key from previous (Last name offset)
19181918
6, # Close search if end of search
1919-
].pack('vvvVv') + last_filename + "\x00" # Last filename returned from find_first or find_next
1919+
].pack('vvvVv') + last_filename.to_s + "\x00" # Last filename returned from find_first or find_next
19201920
resp = trans2(CONST::TRANS2_FIND_NEXT2, parm, '')
19211921
return resp # Returns the FIND_NEXT2 response packet for parsing by the find_first function
19221922
end

0 commit comments

Comments
 (0)