From c3fec0b136d938704d8b0ba82424eea8d17f86ab Mon Sep 17 00:00:00 2001
From: Oliver Kiddle <okiddle@yahoo.co.uk>
Date: Sat, 24 Mar 2018 15:02:41 +0100
Subject: [PATCH 1/2] 42518, CVE-2018-1071: check bounds when copying path in
 hashcmd()

Upstream-commit: 679b71ec4d852037fe5f73d35bf557b0f406c8d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 Src/exec.c  | 2 +-
 Src/utils.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Src/exec.c b/Src/exec.c
index 6d47935..b9ffb35 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -860,7 +860,7 @@ hashcmd(char *arg0, char **pp)
     for (; *pp; pp++)
 	if (**pp == '/') {
 	    s = buf;
-	    strucpy(&s, *pp);
+	    struncpy(&s, *pp, PATH_MAX);
 	    *s++ = '/';
 	    if ((s - buf) + strlen(arg0) >= PATH_MAX)
 		continue;
diff --git a/Src/utils.c b/Src/utils.c
index 391d020..c6eba63 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -2010,10 +2010,10 @@ struncpy(char **s, char *t, int n)
 {
     char *u = *s;
 
-    while (n--)
-	*u++ = *t++;
+    while (n-- && (*u++ = *t++));
     *s = u;
-    *u = '\0';
+    if (n > 0) /* just one null-byte will do, unlike strncpy(3) */
+	*u = '\0';
 }
 
 /* Return the number of elements in an array of pointers. *
-- 
2.14.3


From 88b8110331ac616a8450fab0b87a65df715ee3a8 Mon Sep 17 00:00:00 2001
From: Oliver Kiddle <okiddle@yahoo.co.uk>
Date: Wed, 28 Mar 2018 09:00:58 +0200
Subject: [PATCH 2/2] 42539: prevent overflow of PATH_MAX-sized buffer in
 spelling correction

Upstream-commit: c053c6a0799397632df9ba88f8812a1da49c67f1
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 Src/utils.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/Src/utils.c b/Src/utils.c
index 3989c8c..bac12a9 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -2010,7 +2010,8 @@ struncpy(char **s, char *t, int n)
 {
     char *u = *s;
 
-    while (n-- && (*u++ = *t++));
+    while (n-- && (*u = *t++))
+	u++;
     *s = u;
     if (n > 0) /* just one null-byte will do, unlike strncpy(3) */
 	*u = '\0';
@@ -3745,17 +3746,20 @@ spname(char *oldname)
 	     * odd to the human reader, and we may make use of the total  *
 	     * distance for all corrections at some point in the future.  */
 	    if (bestdist < maxthresh) {
-		strcpy(new, spnameguess);
-		strcat(new, old);
-		return newname;
+		struncpy(&new, spnameguess, sizeof(newname) - (new - newname));
+		struncpy(&new, old, sizeof(newname) - (new - newname));
+		return (new - newname) >= (sizeof(newname)-1) ? NULL : newname;
 	    } else
 	    	return NULL;
 	} else {
 	    maxthresh = bestdist + thresh;
 	    bestdist += thisdist;
 	}
-	for (p = spnamebest; (*new = *p++);)
+	for (p = spnamebest; (*new = *p++);) {
+	    if ((new - newname) >= (sizeof(newname)-1))
+		return NULL;
 	    new++;
+	}
     }
 }
 
-- 
2.17.2