The GNU Bourne-Again SHell - Patches: patch #10035, fix regression in 5.1: 1-byte...
You are not allowed to post comments on this tracker with your current authentication level.
patch #10035: fix regression in 5.1: 1-byte buffer overflow read in subst.c read_comsub
Submitter: | Platon Pronko <rogach> | ||
Submitted: | Mon 01 Mar 2021 05:15:14 PM UTC | ||
Votes: | 20 | ||
Category: | None | Priority: | 5 - Normal |
Status: | Done | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
Jump to the original submission
Fri 04 Feb 2022 11:32:10 AM UTC, comment #6: |
Platon Pronko <rogach> |
Fri 04 Feb 2022 11:22:41 AM UTC, comment #5: I've tested this patch on two productive systems for a long while without any problems.
|
Max Mehl <mxmehl> |
Fri 22 Oct 2021 02:40:23 PM UTC, comment #4:
|
Max Mehl <mxmehl> |
Fri 22 Oct 2021 12:45:55 PM UTC, comment #3:
|
Platon Pronko <rogach> |
Fri 22 Oct 2021 11:44:07 AM UTC, comment #2:
|
Max Mehl <mxmehl> |
Mon 01 Mar 2021 09:50:40 PM UTC, comment #1: Thanks for the report. |
Chet Ramey <chet>![]() |
Mon 01 Mar 2021 05:15:14 PM UTC, original submission:
read_comsub() calls mbrtowc() with bufn+1, which allows 1-byte out-of-bounds read if multibyte character happens to start exactly one byte before the buffer end.
|
Platon Pronko <rogach> |
Depends on the following items: None found
Items that depend on this one: None found
There are 20 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2021-10-22 | mxmehl | Carbon-Copy | - | ![]() |
Added mxmehl |
2021-03-01 | chet | Status | None | ![]() |
Done |
2021-03-01 | rogach | Attached File | - | ![]() |
Added subst.patch, #50956 |
Attached File | - | ![]() |
Added reproducer.sh, #50957 | ||
Attached File | - | ![]() |
Added input.txt, #50958 |
I think this is already merged, and released as a patch to 5.1 version: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-014
So I suspect that the ball is in Debian's court now.