Re: sharutils obscure fscanf() buffer overflow

[Bruce Korb]

Bruce Korb wrote:
> 
> Ulf Härnhammar wrote:
> >
> > Hello,
> >
> > I have found an obscure buffer overflow in shar from the sharutils 4.2.1
> > package.
> >
> > The shar command executes wc when creating shar archives. In the rather
> > unlikely scenario where there is a malicious wc command installed that
> > prints lots of output, a buffer overflow will occur in shar, because of a
> > "%s" format string in an fscanf() call in shar.c.
> >
> > This is of course no serious security threat. Nevertheless, I think it
> > is worth fixing, as the Right Thing for a program should be not to assume
> > anything about its input and to handle various problems well.
> >
> > I have attached a patch against sharutils-4.2.1 and an evil wc command that
> > exhibits this problem in shar on my machine (Debian GNU/Linux testing).
> >
> > // Ulf Harnhammar
> >    http://www.advogato.org/person/metaur/

You were right, I was too hasty.  I read several emails about
an extrememly similar issue, all of which had been addressed in the code.
This one had not.  As soon as I am allowed to fix this, I will.
Regards, Bruce