bug-bash
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Bash-3.2 Official Patch 34


From: Chet Ramey
Subject: Bash-3.2 Official Patch 34
Date: Fri, 2 May 2008 23:46:27 -0400

                             BASH PATCH REPORT
                             =================

Bash-Release: 3.2
Patch-ID: bash32-034

Bug-Reported-by:        Ian Campbell <address@hidden>
Bug-Reference-ID:       <address@hidden>
Bug-Reference-URL:      
http://lists.gnu.org/archive/html/bug-bash/2007-10/msg00060.html

Bug-Description:

The bash getcwd replacement will write past the end of allocated memory
when it allocates the buffer itself if it uses the buffer size passed as
an argument, and that size is less than the length of the pathname.

Patch:

*** ../bash-3.2-patched/lib/sh/getcwd.c 2004-07-21 17:15:19.000000000 -0400
--- lib/sh/getcwd.c     2007-12-31 19:26:36.000000000 -0500
***************
*** 252,268 ****
    {
      size_t len = pathbuf + pathsize - pathp;
      if (buf == NULL)
        {
!       if (len < (size_t) size)
!         len = size;
!       buf = (char *) malloc (len);
        if (buf == NULL)
          goto lose2;
        }
!     else if ((size_t) size < len)
!       {
!       errno = ERANGE;
!       goto lose2;
!       }
      (void) memcpy((PTR_T) buf, (PTR_T) pathp, len);
    }
--- 287,305 ----
    {
      size_t len = pathbuf + pathsize - pathp;
+     if (buf == NULL && size <= 0)
+       size = len;
+ 
+     if ((size_t) size < len)
+       {
+       errno = ERANGE;
+       goto lose2;
+       }
      if (buf == NULL)
        {
!       buf = (char *) malloc (size);
        if (buf == NULL)
          goto lose2;
        }
! 
      (void) memcpy((PTR_T) buf, (PTR_T) pathp, len);
    }
*** ../bash-3.2/patchlevel.h    Thu Apr 13 08:31:04 2006
--- patchlevel.h        Mon Oct 16 14:22:54 2006
***************
*** 26,30 ****
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 33
  
  #endif /* _PATCHLEVEL_H_ */
--- 26,30 ----
     looks for to find the patch level (for the sccs version string). */
  
! #define PATCHLEVEL 34
  
  #endif /* _PATCHLEVEL_H_ */

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer

Chet Ramey, ITS, CWRU    address@hidden    http://cnswww.cns.cwru.edu/~chet/




reply via email to

[Prev in Thread] Current Thread [Next in Thread]