diff options
| author | Axel Beckert <abe@deuxchevaux.org> | 2018-04-05 01:19:04 +0200 |
|---|---|---|
| committer | Axel Beckert <abe@deuxchevaux.org> | 2018-04-05 01:27:40 +0200 |
| commit | d49689fe447363cdb431d50e18cd71f557afc4d6 (patch) | |
| tree | f40e22df47b5bbb93c643d9c1ceab643e2d3aa8f /debian/patches/CVE-2018-1071.patch | |
| parent | 7e1a0050e7991391408f27dc159e1f18f0856518 (diff) | |
| download | zsh-d49689fe447363cdb431d50e18cd71f557afc4d6.tar.gz zsh-d49689fe447363cdb431d50e18cd71f557afc4d6.zip | |
Cherry-pick upstream patches to fix CVE-2018-1071 + CVE-2018-1083
* CVE-2018-1071 (Check bounds when copying path in "hashcmd()".
Closes: #894044)
* CVE-2018-1083 (Check bounds on PATH_MAX-sized buffer used for file
completion candidates. Closes: #894043)
Gbp-Dch: Full
Diffstat (limited to 'debian/patches/CVE-2018-1071.patch')
| -rw-r--r-- | debian/patches/CVE-2018-1071.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/debian/patches/CVE-2018-1071.patch b/debian/patches/CVE-2018-1071.patch new file mode 100644 index 000000000..89ca5853f --- /dev/null +++ b/debian/patches/CVE-2018-1071.patch @@ -0,0 +1,34 @@ +Description: CVE-2018-1071 + Check bounds when copying path in hashcmd(). +Origin: 679b71ec4d852037fe5f73d35bf557b0f406c8d4 +Author: Oliver Kiddle <okiddle@yahoo.co.uk> +Bug-Debian: https://bugs.debian.org/894043 +Bug-CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1083 + +--- a/Src/exec.c ++++ b/Src/exec.c +@@ -920,7 +920,7 @@ + for (; *pp; pp++) + if (**pp == '/') { + s = buf; +- strucpy(&s, *pp); ++ struncpy(&s, *pp, PATH_MAX); + *s++ = '/'; + if ((s - buf) + strlen(arg0) >= PATH_MAX) + continue; +--- a/Src/utils.c ++++ b/Src/utils.c +@@ -2283,10 +2283,10 @@ + { + char *u = *s; + +- while (n--) +- *u++ = *t++; ++ while (n-- && (*u++ = *t++)); + *s = u; +- *u = '\0'; ++ if (n > 0) /* just one null-byte will do, unlike strncpy(3) */ ++ *u = '\0'; + } + + /* Return the number of elements in an array of pointers. * |