The GNU Bourne-Again SHell - Patches: patch #10035, fix regression in 5.1: 1-byte...
You are not allowed to post comments on this tracker with your current authentication level.
patch #10035: fix regression in 5.1: 1-byte buffer overflow read in subst.c read_comsub
Submitter: | Platon Pronko <rogach> | ||
Submitted: | Mon 01 Mar 2021 05:15:14 PM UTC | ||
Votes: | 20 | ||
Category: | None | Priority: | 5 - Normal |
Status: | Done | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
( Jump to the original submission )
Fri 04 Feb 2022 11:32:10 AM UTC, comment #6: |
Platon Pronko <rogach> |
Fri 04 Feb 2022 11:22:41 AM UTC, comment #5: I've tested this patch on two productive systems for a long while without any problems.
What has to be done to get this merged? Is there something I can do? As said, this is a huge blocker to upgrading to Debian stable right now. |
Max Mehl <mxmehl> |
Fri 22 Oct 2021 02:40:23 PM UTC, comment #4:
`LC_ALL=en_GB.UTF-8 ./reproducer.sh` does not fail, while `LC_ALL=C ...` does. |
Max Mehl <mxmehl> |
Fri 22 Oct 2021 12:45:55 PM UTC, comment #3:
|
Platon Pronko <rogach> |
Fri 22 Oct 2021 11:44:07 AM UTC, comment #2:
Interestingly, the reproducer did not throw the expected error on my recent Arch Linux installation, but it did solve an issue we've been having with building the FSFE website.
It would be great if this patch could be merged so downstream users can benefit from this solved problem. |
Max Mehl <mxmehl> |
Mon 01 Mar 2021 09:50:40 PM UTC, comment #1: Thanks for the report. |
Chet Ramey <chet>![]() |
Mon 01 Mar 2021 05:15:14 PM UTC, original submission:
read_comsub() calls mbrtowc() with bufn+1, which allows 1-byte out-of-bounds read if multibyte character happens to start exactly one byte before the buffer end.
The bug can be reliably reproduced on latest master and develop branches. I've attached reproducer.sh script and input.txt (used from the script).
I'm attaching a patch for your consideration - it's simply replacing `bufn+1` with `bufn`, eliminating out-of-bounds read and resulting in correct non-corrupted output. |
Platon Pronko <rogach> |
Depends on the following items: None found
Items that depend on this one: None found
There are 20 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2021-10-22 | mxmehl | Carbon-Copy | - | ![]() |
Added mxmehl |
2021-03-01 | chet | Status | None | ![]() |
Done |
2021-03-01 | rogach | Attached File | - | ![]() |
Added subst.patch, #50956 |
Attached File | - | ![]() |
Added reproducer.sh, #50957 | ||
Attached File | - | ![]() |
Added input.txt, #50958 |
I think this is already merged, and released as a patch to 5.1 version: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-014
So I suspect that the ball is in Debian's court now.