Преглед изворни кода

libdpkg: Fix buffer overflow in path_quote_filename

When the string was longer than the size limit, the loop would continue
as the unsigned size would wrap around 0 to SIZE_MAX, and subsequently
segfault on the out-of-bounds access. Use ssize_t for the size variable.

Regression introduced in f35d66dbc228bc8ad2c5255dee1bf4ecf9ee6e06.
Guillem Jover пре 16 година
родитељ
комит
e759410b2e
1 измењених фајлова са 2 додато и 1 уклоњено
  1. 2 1
      lib/dpkg/path.c

+ 2 - 1
lib/dpkg/path.c

@@ -105,9 +105,10 @@ path_make_temp_template(const char *suffix)
  * but here we escape all 8 bit chars, in order make it simple.
  */
 char *
-path_quote_filename(char *dst, const char *src, size_t size)
+path_quote_filename(char *dst, const char *src, size_t n)
 {
 	char *r = dst;
+	ssize_t size = (ssize_t)n;
 
 	while (size > 0) {
 		switch (*src) {