From 679b71ec4d852037fe5f73d35bf557b0f406c8d4 Mon Sep 17 00:00:00 2001 From: Oliver Kiddle Date: Sat, 24 Mar 2018 15:02:41 +0100 Subject: 42518, CVE-2018-1071: check bounds when copying path in hashcmd() --- ChangeLog | 5 +++++ Src/exec.c | 2 +- Src/utils.c | 6 +++--- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 02d60612b..084d971c2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2018-03-24 Oliver Kiddle + + * 42518, CVE-2018-1071: Src/exec.c, Src/utils.c: + check bounds when copying path in hashcmd() + 2018-03-24 Jun-ichi Takimoto * 42501: Src/Zle/complete.c, Src/Zle/computil.c, diff --git a/Src/exec.c b/Src/exec.c index 35b0bb191..e154d1249 100644 --- a/Src/exec.c +++ b/Src/exec.c @@ -934,7 +934,7 @@ hashcmd(char *arg0, char **pp) for (; *pp; pp++) if (**pp == '/') { s = buf; - strucpy(&s, *pp); + struncpy(&s, *pp, PATH_MAX); *s++ = '/'; if ((s - buf) + strlen(arg0) >= PATH_MAX) continue; diff --git a/Src/utils.c b/Src/utils.c index 3b589aa35..998b16220 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -2283,10 +2283,10 @@ struncpy(char **s, char *t, int n) { char *u = *s; - while (n--) - *u++ = *t++; + while (n-- && (*u++ = *t++)); *s = u; - *u = '\0'; + if (n > 0) /* just one null-byte will do, unlike strncpy(3) */ + *u = '\0'; } /* Return the number of elements in an array of pointers. * -- cgit v1.2.3-70-g09d2