From c3fec0b136d938704d8b0ba82424eea8d17f86ab Mon Sep 17 00:00:00 2001
From: Oliver Kiddle <okiddle@yahoo.co.uk>
Date: Sat, 24 Mar 2018 15:02:41 +0100
Subject: [PATCH] 42518, CVE-2018-1071: check bounds when copying path in
hashcmd()
Upstream-commit: 679b71ec4d852037fe5f73d35bf557b0f406c8d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
Src/exec.c | 2 +-
Src/utils.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/Src/exec.c b/Src/exec.c
index 6d47935..b9ffb35 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -860,7 +860,7 @@ hashcmd(char *arg0, char **pp)
for (; *pp; pp++)
if (**pp == '/') {
s = buf;
- strucpy(&s, *pp);
+ struncpy(&s, *pp, PATH_MAX);
*s++ = '/';
if ((s - buf) + strlen(arg0) >= PATH_MAX)
continue;
diff --git a/Src/utils.c b/Src/utils.c
index 391d020..c6eba63 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -2005,10 +2005,10 @@ struncpy(char **s, char *t, int n)
{
char *u = *s;
- while (n--)
- *u++ = *t++;
+ while (n-- && (*u++ = *t++));
*s = u;
- *u = '\0';
+ if (n > 0) /* just one null-byte will do, unlike strncpy(3) */
+ *u = '\0';
}
/* Return the number of elements in an array of pointers. *
--
2.14.3