Re: [PATCH] Fix buffer overflow in mindist.

[Peter Stephenson <p.w.stephenson@ntlworld.com>]

On Mon, 27 Dec 2010 07:00:23 -0500
Ricky Zhou <ricky@rzhou.org> wrote:
> (reported at https://bugzilla.redhat.com/show_bug.cgi?id=591377)

Reports there are no use to us and we are emphatically *not* in the
position to look at more sources of information, is anyone passing them
on?

> +
> +    /* input was too long and result got truncated */
> +    len = snprintf(buf, sizeof(buf), "%s/%s", dir, mindistguess);
> +    if (len >= sizeof(buf) || len < 0) {
> +        return mindistd;
> +    }
> +

Thanks, we might as well fix the problem robustly since buf is only
needed locally.  (Robustly except for the fact the shell crashes
horribly if it runs out of memory, but there's no hope of fixing that.)

Index: Src/utils.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/utils.c,v
retrieving revision 1.252
diff -p -u -r1.252 utils.c
--- Src/utils.c	20 Dec 2010 10:28:43 -0000	1.252
+++ Src/utils.c	5 Jan 2011 17:15:08 -0000
@@ -3667,16 +3667,22 @@ mindist(char *dir, char *mindistguess, c
     int mindistd, nd;
     DIR *dd;
     char *fn;
-    char buf[PATH_MAX];
+    char *buf;
 
     if (dir[0] == '\0')
 	dir = ".";
     mindistd = 100;
+
+    buf = zalloc(strlen(dir) + strlen(mindistguess) + 2);
     sprintf(buf, "%s/%s", dir, mindistguess);
+
     if (access(unmeta(buf), F_OK) == 0) {
 	strcpy(mindistbest, mindistguess);
+	free(buf);
 	return 0;
     }
+    free(buf);
+
     if (!(dd = opendir(unmeta(dir))))
 	return mindistd;
     while ((fn = zreaddir(dd, 0))) {

-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/