[bug #51841] find buffer-overflow with -printf '%T+'

[Kamil Dudka]

Follow-up Comment #1, bug #51841 (project findutils):

I think that both the bug and the fix are obvious.  After the mentioned
patch,
the code writes 12 bytes into a stack-allocated array of size 6 bytes:

  char fmt[6];

  // [...]

  /* Format the main part of the time. */
  if (kind == '+')
    {
      /* Avoid %F, some Unix versions lack it.  For example:
         HP Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 17 22:59:59 CST 2016
         Also, some older HP-UX versions expand %F as the full month (like
%B).
         Reported by Steven M. Schweda <address@hidden> */
      strcpy (fmt, "%Y-%m-%d+%T");

I believe that increasing size of the fmt array to 12 bytes will fix the bug.


    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?51841>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/