Re: Buffer overflow in name_to_tcb

[email protected] (Joerg Schilling) Mon, 05 Sep 2011 18:15:52 +0200

Newsgroups	gmane.comp.archivers.star.user
Message-ID	<4e64f5b8.Ie/QP/MVwSd5LyS8%[email protected]>

Lasse Kliemann <[email protected]> wrote:

> > I see the workaround has been incorporated into 2011-06-22.
> > =

> > I have compiled that version with my usual CFLAGS including
> > =

> >   -fstack-protector-all -D_FORTIFY_SOURCE=3D2
> > =

> > There were no more problems, although I pushed a dozen TB through =

> > star the last days.
>
> I ran into another problem today. A filename of length 100 inside =

> a directory triggers the bound check, when invoked like so:
>
> star -c d/012345678901234567890123456789012345678901234567890123456789012=
3456789012345678901234567890123456789
>
> I tracked it down to line 201 in longnames.c. Probably line 199 =

> is an issue too. Could the same workaround be applied here? I =

> tried that, and it seems to work, but I am not sure.

The function tcb_to_name() is called while the related strings in the tcb a=
re =

null terminated.

If GCC aborts in tcb_to_name(), the same workaround as before will do.

J=F6rg

-- =

 EMail:[email protected] (home) J=F6rg Schilling D-13353 Be=
rlin
       [email protected]                (uni)  =

       [email protected] (work) Blog: http://schily.blogs=
pot.com/
 URL:  http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily