|
 |
f686d7 |
From e51be32e198f42828b1082f9a40ff525ba892dcb Mon Sep 17 00:00:00 2001
|
|
|
f686d7 |
From: "Barton E. Schaefer" <schaefer@zsh.org>
|
|
|
f686d7 |
Date: Sun, 17 Aug 2014 10:32:02 -0700
|
|
|
f686d7 |
Subject: [PATCH 1/2] Increase size of xbuf2 in xsymlinks to make gcc
|
|
|
f686d7 |
FORTIFY_SOURCE=2 happy.
|
|
|
f686d7 |
|
|
|
f686d7 |
Upstream-commit: 4ba08eef7e15f7fd0c96353d931b764e25fd251d
|
|
|
f686d7 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
f686d7 |
---
|
|
|
f686d7 |
Src/utils.c | 2 +-
|
|
|
f686d7 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
f686d7 |
|
|
|
f686d7 |
diff --git a/Src/utils.c b/Src/utils.c
|
|
|
f686d7 |
index a197ef8..13e744e 100644
|
|
|
f686d7 |
--- a/Src/utils.c
|
|
|
f686d7 |
+++ b/Src/utils.c
|
|
|
f686d7 |
@@ -723,7 +723,7 @@ static int
|
|
|
f686d7 |
xsymlinks(char *s)
|
|
|
f686d7 |
{
|
|
|
f686d7 |
char **pp, **opp;
|
|
|
f686d7 |
- char xbuf2[PATH_MAX*2], xbuf3[PATH_MAX*2];
|
|
|
f686d7 |
+ char xbuf2[PATH_MAX*3], xbuf3[PATH_MAX*2];
|
|
|
f686d7 |
int t0, ret = 0;
|
|
|
f686d7 |
zulong xbuflen = strlen(xbuf);
|
|
|
f686d7 |
|
|
|
f686d7 |
--
|
|
|
f686d7 |
2.14.3
|
|
|
f686d7 |
|
|
|
f686d7 |
|
|
|
f686d7 |
From 5059305b758f1fd228837da436b48a1dcadfd7a3 Mon Sep 17 00:00:00 2001
|
|
|
f686d7 |
From: Peter Stephenson <pws@zsh.org>
|
|
|
f686d7 |
Date: Tue, 9 May 2017 17:49:18 +0100
|
|
|
f686d7 |
Subject: [PATCH 2/2] 40181: Fix buffer overrun in xsymlinks.
|
|
|
f686d7 |
|
|
|
f686d7 |
There was no check for copying to the internal xbuf2 for a
|
|
|
f686d7 |
preliminary test.
|
|
|
f686d7 |
|
|
|
f686d7 |
Upstream-commit: c7a9cf465dd620ef48d586026944d9bd7a0d5d6d
|
|
|
f686d7 |
|
|
|
f686d7 |
The upstream test-case has not been backported because this version
|
|
|
f686d7 |
of zsh does not support the :P modifier.
|
|
|
f686d7 |
|
|
|
f686d7 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
f686d7 |
|
|
|
f686d7 |
Also picked a fix for buffer size off-by-one from upstream commit
|
|
|
f686d7 |
a62e1640bcafbb82d86ea8d8ce057a83c4683d60 to fix the following defect
|
|
|
f686d7 |
newly detected by Coverity Analysis:
|
|
|
f686d7 |
|
|
|
f686d7 |
Error: OVERRUN (CWE-119):
|
|
|
f686d7 |
zsh-5.0.2/Src/utils.c:732: cond_at_most: Checking "xbuflen < 8192UL" implies that "xbuflen" may be up to 8191 on the true branch.
|
|
|
f686d7 |
zsh-5.0.2/Src/utils.c:757: overrun-local: Overrunning array of 8192 bytes at byte offset 8192 by dereferencing pointer "xbuf2 + xbuflen + 1". [Note: The source code implementation of the function has been overridden by a builtin model.]
|
|
|
f686d7 |
---
|
|
|
f686d7 |
Src/utils.c | 18 +++++++++++++-----
|
|
|
f686d7 |
1 file changed, 13 insertions(+), 5 deletions(-)
|
|
|
f686d7 |
|
|
|
f686d7 |
diff --git a/Src/utils.c b/Src/utils.c
|
|
|
f686d7 |
index a197ef8..391d020 100644
|
|
|
f686d7 |
--- a/Src/utils.c
|
|
|
f686d7 |
+++ b/Src/utils.c
|
|
|
f686d7 |
@@ -684,7 +684,7 @@ ispwd(char *s)
|
|
|
f686d7 |
return 0;
|
|
|
f686d7 |
}
|
|
|
f686d7 |
|
|
|
f686d7 |
-static char xbuf[PATH_MAX*2];
|
|
|
f686d7 |
+static char xbuf[PATH_MAX*2+1];
|
|
|
f686d7 |
|
|
|
f686d7 |
/**/
|
|
|
f686d7 |
static char **
|
|
|
f686d7 |
@@ -723,9 +723,9 @@ static int
|
|
|
f686d7 |
xsymlinks(char *s)
|
|
|
f686d7 |
{
|
|
|
f686d7 |
char **pp, **opp;
|
|
|
f686d7 |
- char xbuf2[PATH_MAX*3], xbuf3[PATH_MAX*2];
|
|
|
f686d7 |
+ char xbuf2[PATH_MAX*3+1], xbuf3[PATH_MAX*2+1];
|
|
|
f686d7 |
int t0, ret = 0;
|
|
|
f686d7 |
- zulong xbuflen = strlen(xbuf);
|
|
|
f686d7 |
+ zulong xbuflen = strlen(xbuf), pplen;
|
|
|
f686d7 |
|
|
|
f686d7 |
opp = pp = slashsplit(s);
|
|
|
f686d7 |
for (; xbuflen < sizeof(xbuf) && *pp && ret >= 0; pp++) {
|
|
|
f686d7 |
@@ -744,10 +744,18 @@ xsymlinks(char *s)
|
|
|
f686d7 |
*p = '\0';
|
|
|
f686d7 |
continue;
|
|
|
f686d7 |
}
|
|
|
f686d7 |
- sprintf(xbuf2, "%s/%s", xbuf, *pp);
|
|
|
f686d7 |
+ /* Includes null byte. */
|
|
|
f686d7 |
+ pplen = strlen(*pp) + 1;
|
|
|
f686d7 |
+ if (xbuflen + pplen + 1 > sizeof(xbuf2)) {
|
|
|
f686d7 |
+ *xbuf = 0;
|
|
|
f686d7 |
+ ret = -1;
|
|
|
f686d7 |
+ break;
|
|
|
f686d7 |
+ }
|
|
|
f686d7 |
+ memcpy(xbuf2, xbuf, xbuflen);
|
|
|
f686d7 |
+ xbuf2[xbuflen] = '/';
|
|
|
f686d7 |
+ memcpy(xbuf2 + xbuflen + 1, *pp, pplen);
|
|
|
f686d7 |
t0 = readlink(unmeta(xbuf2), xbuf3, PATH_MAX);
|
|
|
f686d7 |
if (t0 == -1) {
|
|
|
f686d7 |
- zulong pplen = strlen(*pp) + 1;
|
|
|
f686d7 |
if ((xbuflen += pplen) < sizeof(xbuf)) {
|
|
|
f686d7 |
strcat(xbuf, "/");
|
|
|
f686d7 |
strcat(xbuf, *pp);
|
|
|
f686d7 |
--
|
|
|
f686d7 |
2.14.3
|
|
|
f686d7 |
|