Correct a stack underflow in gzip:
- Limit suffix to be no more than 30 bytes long. This matches GNU behavior. - Correct usage of memcpy(). Note that this commit only corrects the stack underflow issue, we still need some other fixes to cover other edges. [1] Reported by: Ron Jude <ronj wytheville org> Discussed with: Matthew Green (original NetBSD gzip author), Eygene Ryabinkin <rea-fbsd codelabs ru> [1] Approved by: re (kib)
This commit is contained in:
parent
aa7eaa2fb6
commit
deb6327793
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=195988
@ -150,6 +150,8 @@ static suffixes_t suffixes[] = {
|
|||||||
};
|
};
|
||||||
#define NUM_SUFFIXES (sizeof suffixes / sizeof suffixes[0])
|
#define NUM_SUFFIXES (sizeof suffixes / sizeof suffixes[0])
|
||||||
|
|
||||||
|
#define SUFFIX_MAXLEN 30
|
||||||
|
|
||||||
static const char gzip_version[] = "FreeBSD gzip 20090621";
|
static const char gzip_version[] = "FreeBSD gzip 20090621";
|
||||||
|
|
||||||
#ifndef SMALL
|
#ifndef SMALL
|
||||||
@ -372,6 +374,8 @@ main(int argc, char **argv)
|
|||||||
case 'S':
|
case 'S':
|
||||||
len = strlen(optarg);
|
len = strlen(optarg);
|
||||||
if (len != 0) {
|
if (len != 0) {
|
||||||
|
if (len > SUFFIX_MAXLEN)
|
||||||
|
errx(1, "incorrect suffix: '%s': too long", optarg);
|
||||||
suffixes[0].zipped = optarg;
|
suffixes[0].zipped = optarg;
|
||||||
suffixes[0].ziplen = len;
|
suffixes[0].ziplen = len;
|
||||||
} else {
|
} else {
|
||||||
@ -1236,7 +1240,7 @@ file_compress(char *file, char *outfile, size_t outsize)
|
|||||||
/* Add (usually) .gz to filename */
|
/* Add (usually) .gz to filename */
|
||||||
if ((size_t)snprintf(outfile, outsize, "%s%s",
|
if ((size_t)snprintf(outfile, outsize, "%s%s",
|
||||||
file, suffixes[0].zipped) >= outsize)
|
file, suffixes[0].zipped) >= outsize)
|
||||||
memcpy(outfile - suffixes[0].ziplen - 1,
|
memcpy(outfile + outsize - suffixes[0].ziplen - 1,
|
||||||
suffixes[0].zipped, suffixes[0].ziplen + 1);
|
suffixes[0].zipped, suffixes[0].ziplen + 1);
|
||||||
|
|
||||||
#ifndef SMALL
|
#ifndef SMALL
|
||||||
|
Loading…
Reference in New Issue
Block a user