GNU nano - Bugs: bug #65407, stack smashing in rpl_glob() when...
You are not allowed to post comments on this tracker with your current authentication level.
bug #65407: stack smashing in rpl_glob() when an include path contains too many slashes
Submitter: | Kalle <nanouser123> | ||
Submitted: | Sun 03 Mar 2024 09:02:06 AM UTC | ||
Severity: | 2 - Minor | Status: | Fixed |
Assigned to: | bens | Open/Closed: | Open |
Mon 04 Mar 2024 11:00:50 AM UTC, comment #3: |
Benno Schulenberg <bens> |
Mon 04 Mar 2024 10:49:19 AM UTC, comment #2: Avoided in git, commit f37d097c, by reporting an error when the include path has more characters than PATH_MAX.
|
Benno Schulenberg <bens> |
Sun 03 Mar 2024 12:24:50 PM UTC, comment #1: A reduced recipe:
For the crash to happen, the string after an `include` command apparently needs to contain more than 6465 slashes. It seems not very likely that someone would accept such a nanorc file from a stranger.
|
Benno Schulenberg <bens> |
Sun 03 Mar 2024 09:02:06 AM UTC, original submission:
Hi!
|
Kalle <nanouser123> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2024-03-04 | bens | Status | None | Fixed | |
Assigned to | None | bens | |||
Summary | stack smashing in rpl_glob() when loading a malicious nanorc file | stack smashing in rpl_glob() when an include path contains too many slashes | |||
2024-03-03 | bens | Severity | 3 - Normal | 2 - Minor | |
Summary | Stack smashing in rpl_glob in glob.c when loading a malicious nano rc file caused by an infinite loop. | stack smashing in rpl_glob() when loading a malicious nanorc file | |||
2024-03-03 | nanouser123 | Attached File | - | Added asanreport.txt, #55771 | |
Attached File | - | Added crash.txt, #55772 |
Powered by Savane 3.13-02a9.
Corresponding source code
Anyway, actually this is a problem in the gnulib globbing module, and it would be better to report it to bug-gnulib.