about summary refs log tree commit diff
path: root/Src/utils.c
diff options
context:
space:
mode:
authorPeter Stephenson <pws@zsh.org>2017-05-09 17:49:18 +0100
committerPeter Stephenson <pws@zsh.org>2017-05-09 17:49:18 +0100
commitc7a9cf465dd620ef48d586026944d9bd7a0d5d6d (patch)
tree167d94dfe05252fd7db0cb573a58b4f0d76565f4 /Src/utils.c
parent263a0c247620f86532424727f7ed07ca7540fbf3 (diff)
downloadzsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.tar.gz
zsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.tar.xz
zsh-c7a9cf465dd620ef48d586026944d9bd7a0d5d6d.zip
40181: Fix buffer overrun in xsymlinks.
There was no check for copying to the internal xbuf2 for a
preliminary test.
Diffstat (limited to 'Src/utils.c')
-rw-r--r--Src/utils.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/Src/utils.c b/Src/utils.c
index ea4b34bab..5eb936bed 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -886,7 +886,7 @@ xsymlinks(char *s, int full)
     char **pp, **opp;
     char xbuf2[PATH_MAX*3+1], xbuf3[PATH_MAX*2+1];
     int t0, ret = 0;
-    zulong xbuflen = strlen(xbuf);
+    zulong xbuflen = strlen(xbuf), pplen;
 
     opp = pp = slashsplit(s);
     for (; xbuflen < sizeof(xbuf) && *pp && ret >= 0; pp++) {
@@ -907,10 +907,18 @@ xsymlinks(char *s, int full)
 	    xbuflen--;
 	    continue;
 	}
-	sprintf(xbuf2, "%s/%s", xbuf, *pp);
+	/* Includes null byte. */
+	pplen = strlen(*pp) + 1;
+	if (xbuflen + pplen + 1 > sizeof(xbuf2)) {
+	    *xbuf = 0;
+	    ret = -1;
+	    break;
+	}
+	memcpy(xbuf2, xbuf, xbuflen);
+	xbuf2[xbuflen] = '/';
+	memcpy(xbuf2 + xbuflen + 1, *pp, pplen);
 	t0 = readlink(unmeta(xbuf2), xbuf3, PATH_MAX);
 	if (t0 == -1) {
-	    zulong pplen = strlen(*pp) + 1;
 	    if ((xbuflen += pplen) < sizeof(xbuf)) {
 		strcat(xbuf, "/");
 		strcat(xbuf, *pp);