diff options
| author | Peter Stephenson <pws@zsh.org> | 2017-05-09 17:49:18 +0100 |
|---|---|---|
| committer | Peter Stephenson <pws@zsh.org> | 2017-05-09 17:49:18 +0100 |
| commit | c7a9cf465dd620ef48d586026944d9bd7a0d5d6d (patch) | |
| tree | 167d94dfe05252fd7db0cb573a58b4f0d76565f4 | |
| parent | 263a0c247620f86532424727f7ed07ca7540fbf3 (diff) | |
| download | zsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.tar.gz zsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.tar.xz zsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.zip | |
40181: Fix buffer overrun in xsymlinks.
There was no check for copying to the internal xbuf2 for a preliminary test.
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | Src/utils.c | 14 | ||||
| -rw-r--r-- | Test/D02glob.ztst | 8 |
3 files changed, 22 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog index 82d4a7086..ee6e918db 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2017-05-09 Peter Stephenson <p.stephenson@samsung.com> + * 41081: Src/utils.c, Test/D02glob.ztst: Symlink expansion + didn't test all buffer length calculations. + * 41078: Src/prompt.c, Test/D01prompt.ztst: Empty psvar could cause bad reference in prompt expansion. diff --git a/Src/utils.c b/Src/utils.c index ea4b34bab..5eb936bed 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -886,7 +886,7 @@ xsymlinks(char *s, int full) char **pp, **opp; char xbuf2[PATH_MAX*3+1], xbuf3[PATH_MAX*2+1]; int t0, ret = 0; - zulong xbuflen = strlen(xbuf); + zulong xbuflen = strlen(xbuf), pplen; opp = pp = slashsplit(s); for (; xbuflen < sizeof(xbuf) && *pp && ret >= 0; pp++) { @@ -907,10 +907,18 @@ xsymlinks(char *s, int full) xbuflen--; continue; } - sprintf(xbuf2, "%s/%s", xbuf, *pp); + /* Includes null byte. */ + pplen = strlen(*pp) + 1; + if (xbuflen + pplen + 1 > sizeof(xbuf2)) { + *xbuf = 0; + ret = -1; + break; + } + memcpy(xbuf2, xbuf, xbuflen); + xbuf2[xbuflen] = '/'; + memcpy(xbuf2 + xbuflen + 1, *pp, pplen); t0 = readlink(unmeta(xbuf2), xbuf3, PATH_MAX); if (t0 == -1) { - zulong pplen = strlen(*pp) + 1; if ((xbuflen += pplen) < sizeof(xbuf)) { strcat(xbuf, "/"); strcat(xbuf, *pp); diff --git a/Test/D02glob.ztst b/Test/D02glob.ztst index 413381f92..0ff696807 100644 --- a/Test/D02glob.ztst +++ b/Test/D02glob.ztst @@ -687,6 +687,14 @@ 0:modifier ':P' resolves symlinks before '..' components *>*glob.tmp/hello/world + # This is a bit brittle as it depends on PATH_MAX. + # We could use sysconf.. + bad_pwd="/${(l:16000:: :):-}" + print ${bad_pwd:P} +0:modifier ':P' with path too long +?(eval):2: path expansion failed, using root directory +>/ + foo=a value="ac" print ${value//[${foo}b-z]/x} |