From: hzoli@cs.elte.hu (Zoltan Hidvegi)
To: kaefer@aglaia.snafu.de (Thorsten Meinecke)
Subject: Re: 2.6b11-t10: -fwritable-strings (and another completion bug)
Date: Sat, 28 Oct 1995 03:22:18 +0100 (MET) [thread overview]
Message-ID: <9510280222.AA00233@turan.elte.hu> (raw)
In-Reply-To: <m0t79m5-00007BC@aglaia.snafu.DE> from "Thorsten Meinecke" at Oct 23, 95 00:25:53 am
Thorsten Meinecke wrote:
> 2) The code that detects if a completed filename is a directory, or
> if a completed parameter's content refers to a directory (with
> AUTO_PARAM_SLASH/GLOB_SUBST set), has arbitrary limits. Try comple-
> tion on a parameter name with more than PATH_MAX chars in length.
> Or try it (with AUTO_PARAM_SLASH on) when the parameter's content
> is more than PATH_MAX in length: the buffer holding only PATH_MAX
> chars will overflow and corrupt the stack.
>
> I'm fixing that by ncalloc()'ing the buffer with a size sufficient
> to hold the parameter, at least PATH_MAX chars. The expanded string,
> although it may be longer, will then be truncated at PATH_MAX-1
> chars. That shouldn't make any difference to stat().
Here is an other version of this fix. It is a bit more readable, and also
fixes a similar problem in an other piece of code.
This patch overrides Thorsten's patch in art. 489, but do not forget, that
this also containd patch in art. 293 from Peter which is still necessary.
The patch applies to vanilla beta11-test10.
Cheers,
Zoltan
*** 1.2 1995/10/23 22:29:11
--- Src/zle_tricky.c 1995/10/23 22:35:51
***************
*** 3179,3185 ****
{
char b[PATH_MAX], *p;
! for (p = b; *nam; nam++)
if (*nam == '\\' && nam[1])
*p++ = *++nam;
else
--- 3179,3185 ----
{
char b[PATH_MAX], *p;
! for (p = b; p < b + sizeof(b) - 1 && *nam; nam++)
if (*nam == '\\' && nam[1])
*p++ = *++nam;
else
***************
*** 3266,3272 ****
if (!(haswhat & HAS_MISC) || (parampre && isset(AUTOPARAMSLASH))) {
/* If we have only filenames or we completed a parameter name
and auto_param_slash is set, lets see if it is a directory. */
! char p[PATH_MAX], *ss;
struct stat buf;
/* Build the path name. */
--- 3266,3272 ----
if (!(haswhat & HAS_MISC) || (parampre && isset(AUTOPARAMSLASH))) {
/* If we have only filenames or we completed a parameter name
and auto_param_slash is set, lets see if it is a directory. */
! char *p;
struct stat buf;
/* Build the path name. */
***************
*** 3277,3302 ****
if (parampre) {
int pl = strlen(parampre);
sprintf(p, "%s%s%s%s", parampre, lpre, str, lsuf);
if (pl && p[pl-1] == Inbrace)
strcpy(p+pl-1, p+pl);
}
else if (ic) {
sprintf(p, "%c%s%s%s%s%s", ic,
ppre, fpre, str, fsuf, psuf);
}
else
! strcpy(p, str);
! ss = dupstring(p);
! tokenize(ss);
! singsub(&ss);
! strcpy(p, ss);
noerrs = ne;
! } else
sprintf(p, "%s%s%s%s%s",
(prpre && *prpre) ? prpre : "./", fpre, str,
fsuf, psuf);
/* And do the stat. */
if (!ztat(p, &buf, 0) && (buf.st_mode & S_IFMT) == S_IFDIR) {
/* It is a directory, so prepare to add the slash and set
--- 3277,3307 ----
if (parampre) {
int pl = strlen(parampre);
+ p = (char *) ncalloc(pl + strlen(lpre) + strlen(str) +
+ strlen(lsuf) + 1);
sprintf(p, "%s%s%s%s", parampre, lpre, str, lsuf);
if (pl && p[pl-1] == Inbrace)
strcpy(p+pl-1, p+pl);
}
else if (ic) {
+ p = (char *) ncalloc(strlen(ppre) + strlen(fpre) + strlen(str) +
+ strlen(fsuf) + strlen(psuf) + 2);
sprintf(p, "%c%s%s%s%s%s", ic,
ppre, fpre, str, fsuf, psuf);
}
else
! p = dupstring(str);
! tokenize(p);
! singsub(&p);
noerrs = ne;
! } else {
! p = (char *) ncalloc((prpre ? strlen(prpre) : 0) + strlen(fpre) +
! strlen(str) + strlen(fsuf) + strlen(psuf) + 3);
sprintf(p, "%s%s%s%s%s",
(prpre && *prpre) ? prpre : "./", fpre, str,
fsuf, psuf);
+ }
/* And do the stat. */
if (!ztat(p, &buf, 0) && (buf.st_mode & S_IFMT) == S_IFDIR) {
/* It is a directory, so prepare to add the slash and set
***************
*** 3549,3555 ****
while (*ap) {
int t2 = ispattern ? strlen(*ap) :
strlen(*ap + off) - boff + 1 + fpl + fsl;
! char pbuf[PATH_MAX], *pb;
struct stat buf;
/* Build the path name for the stat. */
--- 3554,3560 ----
while (*ap) {
int t2 = ispattern ? strlen(*ap) :
strlen(*ap + off) - boff + 1 + fpl + fsl;
! char *pb;
struct stat buf;
/* Build the path name for the stat. */
***************
*** 3562,3568 ****
t2 -= off + boff - 1;
} else {
fprintf(shout, "%s%s%s", fpre, *ap, fsuf);
! sprintf(pb = pbuf, "%s%s%s%s",
(prpre && *prpre) ? prpre : "./", fpre, *ap, fsuf);
}
if (ztat(pb, &buf, 1))
--- 3567,3575 ----
t2 -= off + boff - 1;
} else {
fprintf(shout, "%s%s%s", fpre, *ap, fsuf);
! pb = (char *) ncalloc((prpre ? strlen(prpre) : 0) + 3 +
! strlen(fpre) + strlen(*ap) + strlen(fsuf));
! sprintf(pb, "%s%s%s%s",
(prpre && *prpre) ? prpre : "./", fpre, *ap, fsuf);
}
if (ztat(pb, &buf, 1))
prev parent reply other threads:[~1995-10-28 2:36 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
1995-10-22 23:25 Thorsten Meinecke
1995-10-28 2:22 ` Zoltan Hidvegi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9510280222.AA00233@turan.elte.hu \
--to=hzoli@cs.elte.hu \
--cc=kaefer@aglaia.snafu.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).