[PATCH] Fix buffer overflow in mindist.

[PATCH] Fix buffer overflow in mindist.

[Ricky Zhou]

[-- Attachment #1: Type: text/plain, Size: 926 bytes --]

(reported at https://bugzilla.redhat.com/show_bug.cgi?id=591377)

---
 Src/utils.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/Src/utils.c b/Src/utils.c
index b64530b..513bc7e 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -3665,14 +3665,21 @@ static int
 mindist(char *dir, char *mindistguess, char *mindistbest)
 {
     int mindistd, nd;
+    int len;
     DIR *dd;
     char *fn;
-    char buf[PATH_MAX];
+    char buf[PATH_MAX + 1];
 
     if (dir[0] == '\0')
 	dir = ".";
     mindistd = 100;
-    sprintf(buf, "%s/%s", dir, mindistguess);
+
+    /* input was too long and result got truncated */
+    len = snprintf(buf, sizeof(buf), "%s/%s", dir, mindistguess);
+    if (len >= sizeof(buf) || len < 0) {
+        return mindistd;
+    }
+
     if (access(unmeta(buf), F_OK) == 0) {
 	strcpy(mindistbest, mindistguess);
 	return 0;
-- 
1.7.3.4


[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH] Fix buffer overflow in mindist.

[Peter Stephenson]

On Mon, 27 Dec 2010 07:00:23 -0500
Ricky Zhou <ricky@rzhou.org> wrote:
> (reported at https://bugzilla.redhat.com/show_bug.cgi?id=591377)

Reports there are no use to us and we are emphatically *not* in the
position to look at more sources of information, is anyone passing them
on?

> +
> +    /* input was too long and result got truncated */
> +    len = snprintf(buf, sizeof(buf), "%s/%s", dir, mindistguess);
> +    if (len >= sizeof(buf) || len < 0) {
> +        return mindistd;
> +    }
> +

Thanks, we might as well fix the problem robustly since buf is only
needed locally.  (Robustly except for the fact the shell crashes
horribly if it runs out of memory, but there's no hope of fixing that.)

Index: Src/utils.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/utils.c,v
retrieving revision 1.252
diff -p -u -r1.252 utils.c
--- Src/utils.c	20 Dec 2010 10:28:43 -0000	1.252
+++ Src/utils.c	5 Jan 2011 17:15:08 -0000
@@ -3667,16 +3667,22 @@ mindist(char *dir, char *mindistguess, c
     int mindistd, nd;
     DIR *dd;
     char *fn;
-    char buf[PATH_MAX];
+    char *buf;
 
     if (dir[0] == '\0')
 	dir = ".";
     mindistd = 100;
+
+    buf = zalloc(strlen(dir) + strlen(mindistguess) + 2);
     sprintf(buf, "%s/%s", dir, mindistguess);
+
     if (access(unmeta(buf), F_OK) == 0) {
 	strcpy(mindistbest, mindistguess);
+	free(buf);
 	return 0;
     }
+    free(buf);
+
     if (!(dd = opendir(unmeta(dir))))
 	return mindistd;
     while ((fn = zreaddir(dd, 0))) {

-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/

Re: [PATCH] Fix buffer overflow in mindist.

[Ricky Zhou]

[-- Attachment #1: Type: text/plain, Size: 763 bytes --]

On 2011-01-05 05:20:29 PM, Peter Stephenson wrote:
> > (reported at https://bugzilla.redhat.com/show_bug.cgi?id=591377)
> 
> Reports there are no use to us and we are emphatically *not* in the
> position to look at more sources of information, is anyone passing them
> on?
I know, just thought I'd give credit to original reporter with the
link.  In this case, I was passing on report by way of the patch -
normally, the package maintainers who get those bugs would pass them on
to zsh developers.

> Thanks, we might as well fix the problem robustly since buf is only
> needed locally.  (Robustly except for the fact the shell crashes
> horribly if it runs out of memory, but there's no hope of fixing that.)
Looks good, thanks!

Thanks,
Ricky

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]