From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 22969 invoked by alias); 5 Jan 2011 17:56:25 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: X-Seq: 28568 Received: (qmail 1253 invoked from network); 5 Jan 2011 17:56:21 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham version=3.3.1 Received-SPF: pass (ns1.primenet.com.au: SPF record at ntlworld.com designates 81.103.221.56 as permitted sender) Date: Wed, 5 Jan 2011 17:20:29 +0000 From: Peter Stephenson To: zsh-workers@zsh.org Subject: Re: [PATCH] Fix buffer overflow in mindist. Message-ID: <20110105172029.0b2e1de6@pws-pc.ntlworld.com> In-Reply-To: <20101227120023.GA27174@alpha.rzhou.org> References: <20101227120023.GA27174@alpha.rzhou.org> X-Mailer: Claws Mail 3.7.8 (GTK+ 2.22.0; x86_64-redhat-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Cloudmark-Analysis: v=1.1 cv=JvdXmxIgLJv2/GthKqHpGJEEHukvLcvELVXUanXFreg= c=1 sm=0 a=UFCuWAcE2xAA:10 a=kj9zAlcOel0A:10 a=21c8c_67AAAA:8 a=20KFwNOVAAAA:8 a=NLZqzBF-AAAA:8 a=NOhGdXPOm4Gtsb4_NY8A:9 a=-1U59I8MyOUMBN3ZassA:7 a=5kcRFb6TjRNdgLGA_sN2F1_J2MwA:4 a=CjuIK1q_8ugA:10 a=t_b4wO5MBi4A:10 a=_dQi-Dcv4p4A:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117 On Mon, 27 Dec 2010 07:00:23 -0500 Ricky Zhou wrote: > (reported at https://bugzilla.redhat.com/show_bug.cgi?id=591377) Reports there are no use to us and we are emphatically *not* in the position to look at more sources of information, is anyone passing them on? > + > + /* input was too long and result got truncated */ > + len = snprintf(buf, sizeof(buf), "%s/%s", dir, mindistguess); > + if (len >= sizeof(buf) || len < 0) { > + return mindistd; > + } > + Thanks, we might as well fix the problem robustly since buf is only needed locally. (Robustly except for the fact the shell crashes horribly if it runs out of memory, but there's no hope of fixing that.) Index: Src/utils.c =================================================================== RCS file: /cvsroot/zsh/zsh/Src/utils.c,v retrieving revision 1.252 diff -p -u -r1.252 utils.c --- Src/utils.c 20 Dec 2010 10:28:43 -0000 1.252 +++ Src/utils.c 5 Jan 2011 17:15:08 -0000 @@ -3667,16 +3667,22 @@ mindist(char *dir, char *mindistguess, c int mindistd, nd; DIR *dd; char *fn; - char buf[PATH_MAX]; + char *buf; if (dir[0] == '\0') dir = "."; mindistd = 100; + + buf = zalloc(strlen(dir) + strlen(mindistguess) + 2); sprintf(buf, "%s/%s", dir, mindistguess); + if (access(unmeta(buf), F_OK) == 0) { strcpy(mindistbest, mindistguess); + free(buf); return 0; } + free(buf); + if (!(dd = opendir(unmeta(dir)))) return mindistd; while ((fn = zreaddir(dd, 0))) { -- Peter Stephenson Web page now at http://homepage.ntlworld.com/p.w.stephenson/