patchThe GNU Bourne-Again SHell - Patches: patch #10035, fix regression in 5.1: 1-byte...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10035: fix regression in 5.1: 1-byte buffer overflow read in subst.c read_comsub

Submitted by:  Platon Pronko <rogach>
Submitted on:  Mon 01 Mar 2021 05:15:14 PM UTC  
 
Category:  None Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  None Open/Closed:  Open

Mon 01 Mar 2021 09:50:40 PM UTC, comment #1: 

Thanks for the report.

Chet Ramey <chet>
Project Administrator
Mon 01 Mar 2021 05:15:14 PM UTC, original submission:  

read_comsub() calls mbrtowc() with bufn+1, which allows 1-byte out-of-bounds read if multibyte character happens to start exactly one byte before the buffer end.

The bug can be reliably reproduced on latest master and develop branches. I've attached reproducer.sh script and input.txt (used from the script).
When bug is triggered, "iconv: illegal input sequence at position 513" error message is printed - even though input.txt itself is quite valid utf.

I'm attaching a patch for your consideration - it's simply replacing `bufn+1` with `bufn`, eliminating out-of-bounds read and resulting in correct non-corrupted output.

Platon Pronko <rogach>

 

Attached Files
file #50956:  subst.patch added by rogach (479B - text/x-patch)
file #50957:  reproducer.sh added by rogach (234B - application/x-shellscript)
file #50958:  input.txt added by rogach (514B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by rogach (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-03-01 chet StatusNone => Done
    2021-03-01 rogach Attached File- => Added subst.patch, #50956
        Attached File- => Added reproducer.sh, #50957
        Attached File- => Added input.txt, #50958

    Back to the top


    Powered by Savane 3.6