Delivered-To: james@youngman.org Received: by 10.15.110.129 with SMTP id ch1csp49446eeb; Wed, 15 May 2013 16:48:34 -0700 (PDT) X-Received: by 10.49.0.163 with SMTP id 3mr2890256qef.14.1368661713451; Wed, 15 May 2013 16:48:33 -0700 (PDT) Return-Path: Received: from fencepost.gnu.org (fencepost.gnu.org. [2001:4830:134:3::e]) by mx.google.com with ESMTPS id w3si2996252qer.18.2013.05.15.16.48.32 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Wed, 15 May 2013 16:48:33 -0700 (PDT) Received-SPF: neutral (google.com: 2001:4830:134:3::e is neither permitted nor denied by best guess record for domain of ldv@altlinux.org) client-ip=2001:4830:134:3::e; Authentication-Results: mx.google.com; spf=neutral (google.com: 2001:4830:134:3::e is neither permitted nor denied by best guess record for domain of ldv@altlinux.org) smtp.mail=ldv@altlinux.org Received: from eggs.gnu.org ([2001:4830:134:3::10]:43162) by fencepost.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1UclQr-0006Z3-0A for jay@gnu.org; Wed, 15 May 2013 19:48:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UclQp-0001S9-Sa for jay@gnu.org; Wed, 15 May 2013 19:48:28 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-99.8 required=5.0 tests=BAYES_50,RP_MATCHES_RCVD, USER_IN_WHITELIST autolearn=disabled version=3.3.2 Received: from vint.altlinux.org ([194.107.17.35]:46778) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UclQm-0001F4-Nn; Wed, 15 May 2013 19:48:24 -0400 Received: from wo.int.altlinux.org (wo.int.altlinux.org [192.168.1.4]) by vint.altlinux.org (Postfix) with ESMTP id 23FAC3F8000F; Wed, 15 May 2013 23:48:22 +0000 (UTC) Received: by wo.int.altlinux.org (Postfix, from userid 508) id EEC9C3F48645; Thu, 16 May 2013 03:48:21 +0400 (MSK) Date: Thu, 16 May 2013 03:48:21 +0400 From: "Dmitry V. Levin" To: James Youngman Cc: bug-findutils@gnu.org Subject: [PATCH] find: fix potential buffer overflow in -execdir and -okdir Message-ID: <20130515234821.GA27660@altlinux.org> Mail-Followup-To: James Youngman , bug-findutils@gnu.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x (no timestamps) [generic] X-Received-From: 194.107.17.35 * lib/buildcmd.c (bc_push_arg): Take prefix length into account to avoid state->argbuf overflow. * NEWS: Mention this fix. --- It would be a security issue if one could control factors triggering this bug, which include a directory with thousands of files. ChangeLog | 7 +++++++ NEWS | 2 ++ lib/buildcmd.c | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e6914ff..7b4f3e0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2013-05-15 Dmitry V. Levin + + find: fix potential buffer overflow in -execdir and -okdir. + * lib/buildcmd.c (bc_push_arg): Take prefix length into account + to avoid state->argbuf overflow. + * NEWS: Mention this fix. + 2013-04-22 Paul Eggert More removal of support for -perm +MODE. diff --git a/NEWS b/NEWS index 4349a21..010ba6e 100644 --- a/NEWS +++ b/NEWS @@ -30,6 +30,8 @@ The documentation for xargs now warns about parallel processes (xargs Some bugs in 4.5.11 were fixed without adding them to the bug database, though they are in the ChangeLog: +*** find -execdir/-okdir potential buffer overflow. + *** Use of [[ ... ]] in find/testsuite/sv-bug-32043.sh *** Don't delete header files in "lib/" for "make clean". diff --git a/lib/buildcmd.c b/lib/buildcmd.c index d135692..2616ed6 100644 --- a/lib/buildcmd.c +++ b/lib/buildcmd.c @@ -364,7 +364,7 @@ bc_push_arg (struct buildcmd_control *ctl, if (!terminate) { - if (state->cmd_argv_chars + len > ctl->arg_max) + if (state->cmd_argv_chars + len + pfxlen > ctl->arg_max) { if (initial_args || state->cmd_argc == ctl->initial_argc) error (EXIT_FAILURE, 0, -- ldv