diff options
author | Oliver Kiddle <okiddle@yahoo.co.uk> | 2018-03-24 15:04:39 +0100 |
---|---|---|
committer | Oliver Kiddle <okiddle@yahoo.co.uk> | 2018-03-24 15:04:39 +0100 |
commit | 259ac472eac291c8c103c7a0d8a4eaf3c2942ed7 (patch) | |
tree | 467a11ce5cf8e5e970565f2d7bb93bfe5f8775d0 | |
parent | 679b71ec4d852037fe5f73d35bf557b0f406c8d4 (diff) | |
download | zsh-259ac472eac291c8c103c7a0d8a4eaf3c2942ed7.tar.gz zsh-259ac472eac291c8c103c7a0d8a4eaf3c2942ed7.tar.xz zsh-259ac472eac291c8c103c7a0d8a4eaf3c2942ed7.zip |
42519, CVE-2018-1083: check bounds on PATH_MAX-sized buffer used for file completion candidates
-rw-r--r-- | ChangeLog | 3 | ||||
-rw-r--r-- | Src/Zle/compctl.c | 6 |
2 files changed, 9 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index 084d971c2..5c1806cf7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2018-03-24 Oliver Kiddle <okiddle@yahoo.co.uk> + * 42519, CVE-2018-1083: Src/Zle/compctl.c: check bounds on + PATH_MAX-sized buffer used for file completion candidates + * 42518, CVE-2018-1071: Src/exec.c, Src/utils.c: check bounds when copying path in hashcmd() diff --git a/Src/Zle/compctl.c b/Src/Zle/compctl.c index e9d165780..87d13afc1 100644 --- a/Src/Zle/compctl.c +++ b/Src/Zle/compctl.c @@ -2176,6 +2176,8 @@ gen_matches_files(int dirs, int execs, int all) if (prpre && *prpre) { pathpref = dupstring(prpre); unmetafy(pathpref, &pathpreflen); + if (pathpreflen > PATH_MAX) + return; /* system needs NULL termination, not provided by unmetafy */ pathpref[pathpreflen] = '\0'; } else { @@ -2218,6 +2220,8 @@ gen_matches_files(int dirs, int execs, int all) * the path buffer by appending the filename. */ ums = dupstring(n); unmetafy(ums, ¨en); + if (umlen + pathpreflen + 1 > PATH_MAX) + continue; memcpy(q, ums, umlen); q[umlen] = '\0'; /* And do the stat. */ @@ -2232,6 +2236,8 @@ gen_matches_files(int dirs, int execs, int all) /* We have to test for a path suffix. */ int o = strlen(p), tt; + if (o + strlen(psuf) > PATH_MAX) + continue; /* Append it to the path buffer. */ strcpy(p + o, psuf); |