d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't hard-code the number of compression utility arguments.

Browse Source 
The zstd invocation constructed by newsyslog contains one more parameter
than invocations for the other supported compression utilities.  However,
the maximum number of arguments was hard-coded, leading to an
out-of-bounds array access when using zstd compression.
This commit is contained in:
markj 2018-08-01 18:45:33 +00:00
parent 32ba85e04a
commit 59ae15e1bd
1 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
usr.sbin/newsyslog/newsyslog.c
View File

@ -153,23 +153,24 @@ struct compress_types {
const char *suffix; /* Compression suffix */
const char *path; /* Path to compression program */
char **args; /* Compression program arguments */
int nargs; /* Program argument count */
};
static char f_arg[] = "-f";
static char q_arg[] = "-q";
static char rm_arg[] = "--rm";
static char *gz_args[] ={ NULL, f_arg, NULL, NULL };
#define bzip2_args gz_args
static char *gz_args[] = { NULL, f_arg, NULL, NULL };
#define bz2_args gz_args
#define xz_args gz_args
static char *zstd_args[] = { NULL, q_arg, rm_arg, NULL, NULL };
#define ARGS_NUM 4
#define ARGS_NUM 5
static const struct compress_types compress_type[COMPRESS_TYPES] = {
{ "", "", "", NULL}, /* none */
{ "Z", COMPRESS_SUFFIX_GZ, _PATH_GZIP, gz_args}, /* gzip */
{ "J", COMPRESS_SUFFIX_BZ2, _PATH_BZIP2, bzip2_args}, /* bzip2 */
{ "X", COMPRESS_SUFFIX_XZ, _PATH_XZ, xz_args }, /* xz */
{ "Y", COMPRESS_SUFFIX_ZST, _PATH_ZSTD, zstd_args } /* zst */
{ "", "", "", NULL, 0},
{ "Z", COMPRESS_SUFFIX_GZ, _PATH_GZIP, gz_args, nitems(gz_args) },
{ "J", COMPRESS_SUFFIX_BZ2, _PATH_BZIP2, bz2_args, nitems(bz2_args) },
{ "X", COMPRESS_SUFFIX_XZ, _PATH_XZ, xz_args, nitems(xz_args) },
{ "Y", COMPRESS_SUFFIX_ZST, _PATH_ZSTD, zstd_args, nitems(zstd_args) }
};
struct conf_entry {
@ -2027,23 +2028,24 @@ do_zipwork(struct zipwork_entry *zwork)
char zresult[MAXPATHLEN];
char command[BUFSIZ];
char **args;
int c, i;
int c, i, nargs;
assert(zwork != NULL);
pgm_path = NULL;
strlcpy(zresult, zwork->zw_fname, sizeof(zresult));
args = calloc(ARGS_NUM, sizeof(*args));
if (args == NULL)
err(1, "calloc()");
if (zwork->zw_conf != NULL &&
zwork->zw_conf->compress > COMPRESS_NONE)
for (c = 1; c < COMPRESS_TYPES; c++) {
if (zwork->zw_conf->compress == c) {
nargs = compress_type[c].nargs;
args = calloc(nargs, sizeof(*args));
if (args == NULL)
err(1, "calloc()");
pgm_path = compress_type[c].path;
(void) strlcat(zresult,
compress_type[c].suffix, sizeof(zresult));
/* the first argument is always NULL, skip it */
for (i = 1; i < ARGS_NUM; i++) {
for (i = 1; i < nargs; i++) {
if (compress_type[c].args[i] == NULL)
break;
args[i] = compress_type[c].args[i];