Re: sharutils: Directory traversal (security issue) in uudecode
Paul Eggert <[email protected]> Sun, 27 Nov 2022 09:39:36 -0800
| Newsgroups | gmane.comp.gnu.utils.bugs |
|---|---|
| Organization | UCLA Computer Science Department |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------zE0WehCvMJTYw7Mt0ruczlG4 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit While briefly looking into that bug report I noticed some undefined behavior in uudecode.c. It uses sscanf to scan from and to the same string, which is undefined behavior since sscanf's first argument has the 'restrict' keyword. Proposed patch attached. I haven't compiled or tested this since sharutils doesn't bootstrap these days (I'll follow up with a separate email about that). --------------zE0WehCvMJTYw7Mt0ruczlG4 Content-Type: text/x-patch; charset=UTF-8; name="0001-Avoid-undefined-sscanf-behavor.patch" Content-Disposition: attachment; filename="0001-Avoid-undefined-sscanf-behavor.patch" Content-Transfer-Encoding: base64 RnJvbSBhZDIyYmQ5MDFjNzk2OThmNDEzYTFjZjMxMmU1OGJjZDE2NDg2M2NlIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVjbGEuZWR1 PgpEYXRlOiBTdW4sIDI3IE5vdiAyMDIyIDA5OjM4OjMwIC0wODAwClN1YmplY3Q6IFtQQVRD SF0gQXZvaWQgdW5kZWZpbmVkIHNzY2FuZiBiZWhhdm9yCk1JTUUtVmVyc2lvbjogMS4wCkNv bnRlbnQtVHlwZTogdGV4dC9wbGFpbjsgY2hhcnNldD1VVEYtOApDb250ZW50LVRyYW5zZmVy LUVuY29kaW5nOiA4Yml0CgoqIHNyYy91dWRlY29kZS5jIChkZWNvZGUpOiBEb27igJl0IHNz Y2FuZiBmcm9tIGFuZCB0bwp0aGUgc2FtZSBzdHJpbmcsIGFzIHRoYXQgaGFzIHVuZGVmaW5l ZCBiZWhhdmlvci4KLS0tCiBzcmMvdXVkZWNvZGUuYyB8IDI2ICsrKysrKysrKysrKysrKysr LS0tLS0tLS0tCiAxIGZpbGUgY2hhbmdlZCwgMTcgaW5zZXJ0aW9ucygrKSwgOSBkZWxldGlv bnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvdXVkZWNvZGUuYyBiL3NyYy91dWRlY29kZS5jCmlu ZGV4IGQ2Zjc0MmQuLmIzYTY4YWYgMTAwNjQ0Ci0tLSBhL3NyYy91dWRlY29kZS5jCisrKyBi L3NyYy91dWRlY29kZS5jCkBAIC0xLDQgKzEsMyBAQAotCiBzdGF0aWMgY2hhciBjb25zdCBj cmlnaHRfeWVhcnNfeltdID0KIAogLyogdXVkZWNvZGUgdXRpbGl0eS4KQEAgLTM3MCw2ICsz NjksNyBAQCBkZWNvZGUgKGNoYXIgY29uc3QgKiBpbm5hbWUpCiAgIGNoYXIgKnB6OwogICBp bnQgICBtb2RlOwogICBjaGFyICBidWZbMiAqIEJVRlNJWl0gPSB7IE5VTCB9OworICBjaGFy ICpmbmFtZTsKICAgY2hhciAqb3V0bmFtZTsKICAgYm9vbCAgYWxsb2NhdGVkX291dG5hbWUg PSBmYWxzZTsKICAgYm9vbCAgZW5jb2RlZF9mbmFtZSA9IGZhbHNlOwpAQCAtMzgwLDYgKzM4 MCw4IEBAIGRlY29kZSAoY2hhciBjb25zdCAqIGlubmFtZSkKIAogICB3aGlsZSAoMSkKICAg ICB7CisgICAgICBjaGFyICpubDsKKwogICAgICAgaWYgKGZnZXRzIChidWYsIHNpemVvZiAo YnVmKSwgc3RkaW4pID09IE5VTEwpCiAJewogICAgICAgICBiYWRfYmVnaW5uaW5nOgpAQCAt Mzg3LDEyICszODksMTUgQEAgZGVjb2RlIChjaGFyIGNvbnN0ICogaW5uYW1lKQogICAgICAg ICAgICAgICAgXygiJXM6IEludmFsaWQgb3IgbWlzc2luZyAnYmVnaW4nIGxpbmVcbiIpLCBp bm5hbWUpOwogCX0KIAotICAgICAgaWYgKHN0cmNociAoYnVmLCBOTCkgPT0gTlVMTCkKKyAg ICAgIG5sID0gc3RyY2hyIChidWYsIE5MKTsKKyAgICAgIGlmIChubCA9PSBOVUxMKQogICAg ICAgICBnb3RvIGJhZF9iZWdpbm5pbmc7CisgICAgICAqbmwgPSAnXDAnOwogCiAgICAgICBp ZiAoc3RybmNtcCAoYnVmLCAiYmVnaW4iLCA1KSA9PSAwKQogCXsKICAgICAgICAgICBjaGFy ICogc2NhbiA9IGJ1Zis1OworICAgICAgICAgIGludCBmbmFtZV9vZmZzZXQ7CiAKICAgICAg ICAgY2hlY2tfYmVnaW5fb3B0aW9uOgogCkBAIC00MjksOSArNDM0LDEyIEBAIGRlY29kZSAo Y2hhciBjb25zdCAqIGlubmFtZSkKIAkgICAgfQogICAgICAgICAgIH0KIAotCSAgaWYgKHNz Y2FuZiAoc2NhbiwgIiAlbyAlW15cbl0iLCAmbW9kZSwgYnVmKSA9PSAyKQotCSAgICBicmVh azsKLSAgICAgICAgICBnb3RvIGJhZF9iZWdpbm5pbmc7CisJICBpZiAoc3NjYW5mIChzY2Fu LCAiICVvICVuIiwgJm1vZGUsICZmbmFtZV9vZmZzZXQpICE9IDEpCisJICAgIGdvdG8gYmFk X2JlZ2lubmluZzsKKwkgIGZuYW1lID0gc2NhbiArIGZuYW1lX29mZnNldDsKKwkgIGlmIChm bmFtZSA9PSBubCkKKwkgICAgZ290byBiYWRfYmVnaW5uaW5nOworICAgICAgICAgIGJyZWFr OwogCX0KICAgICB9CiAKQEAgLTQ0MSwxNSArNDQ5LDE1IEBAIGRlY29kZSAoY2hhciBjb25z dCAqIGlubmFtZSkKICAgZWxzZQogICAgIHsKICAgICAgIGlmIChlbmNvZGVkX2ZuYW1lKQot ICAgICAgICBkZWNvZGVfZm5hbWUgKGJ1Zik7CisgICAgICAgIGRlY29kZV9mbmFtZSAoZm5h bWUpOwogCi0gICAgICBpZiAoYnVmWzBdICE9ICd+JykKLQlvdXRuYW1lID0gYnVmOworICAg ICAgaWYgKGZuYW1lWzBdICE9ICd+JykKKwlvdXRuYW1lID0gZm5hbWU7CiAgICAgICBlbHNl CiAgICAgICAgIHsKICAgICAgICAgICAvKiBIYW5kbGUgfnVzZXIvZmlsZSBmb3JtYXQuICAq LwogCi0gICAgICAgICAgb3V0bmFtZSA9IGV4cGFuZF90aWxkZSAoYnVmKTsKKyAgICAgICAg ICBvdXRuYW1lID0gZXhwYW5kX3RpbGRlIChmbmFtZSk7CiAgICAgICAgICAgaWYgKG91dG5h bWUgPT0gTlVMTCkKICAgICAgICAgICAgIHJldHVybiBVVURFQ09ERV9FWElUX05PX09VVFBV VDsKICAgICAgICAgICBhbGxvY2F0ZWRfb3V0bmFtZSA9IHRydWU7Ci0tIAoyLjM4LjEKCg== --------------zE0WehCvMJTYw7Mt0ruczlG4--