Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Coverity CID 1264915, Via FreeBSD (Xin Li) 

When reading in the original file name from gzip header, we read
in PATH_MAX + 1 bytes from the file.  In r281500, strrchr() is
used to strip possible path portion of the file name to mitigate
a possible attack.  Unfortunately, strrchr() expects a buffer
that is NUL-terminated, and since we are processing potentially
untrusted data, we can not assert that be always true.

Solve this by reading in one less byte (now PATH_MAX) and
explicitly terminate the buffer after the read size with NUL.
This commit is contained in:
christos 2015-04-15 02:29:12 +00:00
parent 6c00453054
commit d6eaf99167
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
usr.bin/gzip/gzip.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: gzip.c,v 1.107 2015/01/13 02:37:20 mrg Exp $ */
/* $NetBSD: gzip.c,v 1.108 2015/04/15 02:29:12 christos Exp $ */
/*
* Copyright (c) 1997, 1998, 2003, 2004, 2006 Matthew R. Green
@ -30,7 +30,7 @@
#ifndef lint
__COPYRIGHT("@(#) Copyright (c) 1997, 1998, 2003, 2004, 2006\
Matthew R. Green. All rights reserved.");
__RCSID("$NetBSD: gzip.c,v 1.107 2015/01/13 02:37:20 mrg Exp $");
__RCSID("$NetBSD: gzip.c,v 1.108 2015/04/15 02:29:12 christos Exp $");
#endif /* not lint */
/*
@ -1366,14 +1366,17 @@ file_uncompress(char *file, char *outfile, size_t outsize)
timestamp = ts[3] << 24 | ts[2] << 16 | ts[1] << 8 | ts[0];
if (header1[3] & ORIG_NAME) {
rbytes = pread(fd, name, sizeof name, GZIP_ORIGNAME);
rbytes = pread(fd, name, sizeof(name) - 1, GZIP_ORIGNAME);
if (rbytes < 0) {
maybe_warn("can't read %s", file);
goto lose;
}
if (name[0] != 0) {
if (name[0] != '\0') {
char *dp, *nf;
/* Make sure that name is NUL-terminated */
name[rbytes] = '\0';
/* strip saved directory name */
nf = strrchr(name, '/');
if (nf == NULL)