[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Out-of-bounds read in parse_comsub()
|
From: |
Chet Ramey |
|
Subject: |
Re: Out-of-bounds read in parse_comsub() |
|
Date: |
Fri, 27 Oct 2017 15:19:34 -0400 |
|
User-agent: |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 |
On 10/27/17 11:32 AM, Eduardo A. Bustamante López wrote:
> On Thu, Oct 26, 2017 at 11:07:57PM +0200, Jakub Wilk wrote:
> [...]
>> Bash Version: 20171020 snapshot
>>
>> Apparently an out-of-bounds read can happen in parse_comsub() when checking
>> script sytnax. To reproduce, rebuild bash with AddressSanitizer enabled and
>> run:
>>
>> $ printf
>> '$(00\177%012d\1%d00\177%090d\177%028d(%0267d\177%010d<<-\276%019d\n\n' |
>> bash -n
>
> I can reproduce this error too. It seems `ret' is missing a NUL terminator, so
> `STREQN' reads past the allocated buffer.
Thanks for the report and the pointer to the right place to fix. Here's
the fix I went with.
Chet
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU chet@case.edu http://cnswww.cns.cwru.edu/~chet/
heredoc-overrun.patch
Description: Text document