sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-07-18 01:39:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix off-by-one buffer overflow in f_name() function. It is not clear if this

Browse source 
problem can be exploited.

Submitted by:	several
Obtained from:	http://www.suse.de/~krahmer/rsync-2.6.9-fname-obo.diff
Security:	CVE-2007-4091
Security:	http://www.novell.com/linux/security/advisories/2007_17_sr.html
This commit is contained in:
Pav Lucistnik 2007-08-22 16:17:00 +00:00
parent fec66f7dc3
commit 62b84f0ed4
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=198133
2 changed files with 61 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
net/rsync/Makefile
View file

@ -7,6 +7,7 @@
PORTNAME= rsync PORTNAME= rsync
PORTVERSION= 2.6.9 PORTVERSION= 2.6.9
PORTREVISION= 1
CATEGORIES= net ipv6 CATEGORIES= net ipv6
MASTER_SITES= http://rsync.samba.org/ftp/%SUBDIR%/ \ MASTER_SITES= http://rsync.samba.org/ftp/%SUBDIR%/ \
ftp://ftp.samba.org/pub/%SUBDIR%/ \ ftp://ftp.samba.org/pub/%SUBDIR%/ \

60
net/rsync/files/patch-CVE-2007-4091 Normal file
View file

@ -0,0 +1,60 @@
--- sender.c 2006-09-20 03:53:32.000000000 +0200
+++ sender.c 2007-07-25 15:33:05.000000000 +0200
@@ -123,6 +123,7 @@
char fname[MAXPATHLEN];
struct file_struct *file;
unsigned int offset;
+ size_t l = 0;
if (ndx < 0 || ndx >= the_file_list->count)
return;
@@ -133,6 +134,20 @@
file->dir.root, "/", NULL);
} else
offset = 0;
+
+ l = offset + 1;
+ if (file) {
+ if (file->dirname)
+ l += strlen(file->dirname);
+ if (file->basename)
+ l += strlen(file->basename);
+ }
+
+ if (l >= sizeof(fname)) {
+ rprintf(FERROR, "Overlong pathname\n");
+ exit_cleanup(RERR_FILESELECT);
+ }
+
f_name(file, fname + offset);
if (remove_source_files) {
if (do_unlink(fname) == 0) {
@@ -224,6 +239,7 @@
enum logcode log_code = log_before_transfer ? FLOG : FINFO;
int f_xfer = write_batch < 0 ? batch_fd : f_out;
int i, j;
+ size_t l = 0;
if (verbose > 2)
rprintf(FINFO, "send_files starting\n");
@@ -259,6 +275,20 @@
fname[offset++] = '/';
} else
offset = 0;
+
+ l = offset + 1;
+ if (file) {
+ if (file->dirname)
+ l += strlen(file->dirname);
+ if (file->basename)
+ l += strlen(file->basename);
+ }
+
+ if (l >= sizeof(fname)) {
+ rprintf(FERROR, "Overlong pathname\n");
+ exit_cleanup(RERR_FILESELECT);
+ }
+
fname2 = f_name(file, fname + offset);
if (verbose > 2)