Re: Buffer overflow in name_to_tcb

--===============5079350490389214027==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="IpbVkmxF4tDyP/Kb"
Content-Disposition: inline


--IpbVkmxF4tDyP/Kb
Content-Type: multipart/mixed; boundary="QKdGvSO+nmPlgiQ/"
Content-Disposition: inline


--QKdGvSO+nmPlgiQ/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Message by -Joerg Schilling- from Mon 2011-09-05:
> Lasse Kliemann <[email protected]> wrote:
>=20
> > > I see the workaround has been incorporated into 2011-06-22.
> > >=20
> > > I have compiled that version with my usual CFLAGS including
> > >=20
> > >   -fstack-protector-all -D_FORTIFY_SOURCE=3D2
> > >=20
> > > There were no more problems, although I pushed a dozen TB through=20
> > > star the last days.
> >
> > I ran into another problem today. A filename of length 100 inside=20
> > a directory triggers the bound check, when invoked like so:
> >
> > star -c d/0123456789012345678901234567890123456789012345678901234567890=
123456789012345678901234567890123456789
> >
> > I tracked it down to line 201 in longnames.c. Probably line 199=20
> > is an issue too. Could the same workaround be applied here? I=20
> > tried that, and it seems to work, but I am not sure.
>=20
> The function tcb_to_name() is called while the related strings in the tcb=
 are=20
> null terminated.
>=20
> If GCC aborts in tcb_to_name(), the same workaround as before will do.

GCC aborts in name_to_tcb(), not tcb_to_name().=20

Maybe you meant that?

I'm testing the attached patch now.

--QKdGvSO+nmPlgiQ/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="star-patch.diff"

diff --git a/star/longnames.c b/star/longnames.c
--- a/star/longnames.c
+++ b/star/longnames.c
@@ -196,9 +196,9 @@
 	 * Do actual splitting based on split name pointer 'np'.
 	 */
 	if (add)
-		strcatl(ptb->dbuf.t_name, &np[1], "/", (char *)NULL);
+		strcatl(ptb->ndbuf.t_name, &np[1], "/", (char *)NULL);
 	else
-		strcpy(ptb->dbuf.t_name, &np[1]);
+		strcpy(ptb->ndbuf.t_name, &np[1]);
 	strncpy(ptb->dbuf.t_prefix, name, np - name);
 	info->f_flags |= F_SPLIT_NAME;
 	return (TRUE);

--QKdGvSO+nmPlgiQ/--

--IpbVkmxF4tDyP/Kb
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJOZP5QAAoJEFYll6N4nhdvfDMP/RaeHc8Wpx+iQQjMAQxGTJIo
oRXRcZFlzuxxNgj277dN7xqIstWk8hZhSZAj30XNsn1n7jrIYs7P7ftCGPHDj1Z7
CaO+U53kRxW0pafoTFJTdN77cTJKjm1JfQZYzaQzk/IMKMc2bHnj14Ud+VdWUnjC
4JX46Ps7kfHkDIYqLomIiErv6iN/WDGgSoXv4Ox/cUd22CELGehAlhAA8ozRtmga
N32GjmfZp7J9uQbkwVG8wbl7B8g9LkHYvFPuXX7zA0X1ZmjdRm6PTYQN/UIc3pPO
BD+vcP8rU/qnF5tXslFaL8+Gi0zKazpExQ7uxhxX2MBXOZriJfbQtLtA/HQkuQb5
JDqf8u5+Qbhujvhi/vGge02G90WiADh+UGo0qjVPhe0VTX/vSFmAZsabkJjJxBXU
X2jen+SI7nJmeIttfXDcZ9x2bz/5Hm7XOS1ieUZk6D9quqDpheDxhSkkBU8TsoxM
A2vwN3plw3qHpHZR2FsWfMOeNGE7qHulM/2iTbWzu614ySeFhqjN7azvvLbtV2wL
OpaAfwN+gd4TkHVpoGLYgtmX6tS+szJ2u4BPv84MQvxWTX/TbpdP6unMPf8ed0Gs
3nM90cN+vce+HNLPxl0ijuRWPMB+sSAgpl7Gj0BzR5rDYyHnIO0EJA+ZlngaRtGJ
bzWEluItc4T9FlDr9Uct
=mOkQ
-----END PGP SIGNATURE-----

--IpbVkmxF4tDyP/Kb--

--===============5079350490389214027==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Star-users mailing list
[email protected]
https://lists.berlios.de/mailman/listinfo/star-users

--===============5079350490389214027==--