f09c09f5c0
Multiple (stack-based) buffer overflows in patch canonisation code and when expanding file-names with long paths Patches taken from upstream
73 lines
2.1 KiB
Plaintext
73 lines
2.1 KiB
Plaintext
$OpenBSD: patch-src_os_pl-os_c,v 1.1 2013/01/08 13:36:47 jasper Exp $
|
|
|
|
From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001
|
|
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
|
|
Date: Sun, 16 Dec 2012 18:13:17 +0100
|
|
Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code.
|
|
|
|
Pushes pointers on an automatic array without checking for overflow.
|
|
Can be used for DoS attacks. Will be extremely hard to make it execute
|
|
arbitrary code.
|
|
|
|
Fixes CVE-2012-6089, patch from upstream:
|
|
http://www.swi-prolog.org/git/pl.git/commit/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c
|
|
|
|
--- src/os/pl-os.c.orig Thu Sep 27 20:43:34 2012
|
|
+++ src/os/pl-os.c Tue Jan 8 14:11:56 2013
|
|
@@ -1057,8 +1057,7 @@ cleanupExpand(void)
|
|
char *
|
|
canoniseFileName(char *path)
|
|
{ char *out = path, *in = path, *start = path;
|
|
- char *osave[100];
|
|
- int osavep = 0;
|
|
+ tmp_buffer saveb;
|
|
|
|
#ifdef O_HASDRIVES /* C: */
|
|
if ( in[1] == ':' && isLetter(in[0]) )
|
|
@@ -1097,7 +1096,8 @@ canoniseFileName(char *path)
|
|
in += 2;
|
|
if ( in[0] == '/' )
|
|
*out++ = '/';
|
|
- osave[osavep++] = out;
|
|
+ initBuffer(&saveb);
|
|
+ addBuffer(&saveb, out, char*);
|
|
|
|
while(*in)
|
|
{ if (*in == '/')
|
|
@@ -1113,15 +1113,15 @@ canoniseFileName(char *path)
|
|
}
|
|
if ( in[2] == EOS ) /* delete trailing /. */
|
|
{ *out = EOS;
|
|
- return path;
|
|
+ goto out;
|
|
}
|
|
if ( in[2] == '.' && (in[3] == '/' || in[3] == EOS) )
|
|
- { if ( osavep > 0 ) /* delete /foo/../ */
|
|
- { out = osave[--osavep];
|
|
+ { if ( !isEmptyBuffer(&saveb) ) /* delete /foo/../ */
|
|
+ { out = popBuffer(&saveb, char*);
|
|
in += 3;
|
|
if ( in[0] == EOS && out > start+1 )
|
|
{ out[-1] = EOS; /* delete trailing / */
|
|
- return path;
|
|
+ goto out;
|
|
}
|
|
goto again;
|
|
} else if ( start[0] == '/' && out == start+1 )
|
|
@@ -1135,11 +1135,14 @@ canoniseFileName(char *path)
|
|
in++;
|
|
if ( out > path && out[-1] != '/' )
|
|
*out++ = '/';
|
|
- osave[osavep++] = out;
|
|
+ addBuffer(&saveb, out, char*);
|
|
} else
|
|
*out++ = *in++;
|
|
}
|
|
*out++ = *in++;
|
|
+
|
|
+out:
|
|
+ discardBuffer(&saveb);
|
|
|
|
return path;
|
|
}
|