cirno/plan9port
1
0
Fork 0
mirror of https://github.com/9fans/plan9port.git synced 2025-01-24 11:41:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

mk: fix out of bounds access

Browse source 
A loop is added for each structure field instead of accessing the other
fields through the first one in one loop.

Updates #313

Change-Id: I0e27e15feacb77391bc1decee7cf720d64d14586
This commit is contained in:
Neven Sajko 2019-12-31 21:32:42 +00:00 committed by Dan Cross
parent 194178b578
commit c65d179354
1 changed files with 21 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/cmd/mk/archive.c
View file

@ -1,6 +1,6 @@
#include "mk.h" #include "mk.h"
#define ARMAG "!<arch>\n" #define ARMAG "!<arch>\n"
#define SARMAG 8 #define SARMAG (sizeof(ARMAG) - sizeof(""))
#define ARFMAG "`\n" #define ARFMAG "`\n"
#define SARNAME 16 #define SARNAME 16
@ -102,7 +102,7 @@ atouch(char *name)
LSEEK(fd, SARMAG, 0); LSEEK(fd, SARMAG, 0);
while(read(fd, (char *)&h, sizeof(h)) == sizeof(h)){ while(read(fd, (char *)&h, sizeof(h)) == sizeof(h)){
for(i = SARNAME-1; i > 0 && h.name[i] == ' '; i--) for(i = SARNAME-1; i > 0 && h.name[i] == ' '; i--)
; ;
h.name[i+1]=0; h.name[i+1]=0;
if(strcmp(member, h.name) == 0){ if(strcmp(member, h.name) == 0){
t = SARNAME-sizeof(h); /* ughgghh */ t = SARNAME-sizeof(h); /* ughgghh */
@ -118,6 +118,18 @@ atouch(char *name)
close(fd); close(fd);
} }
static int
allspaces(char *a, int n)
{
int i;
for (i = 0; i < n; i++) {
if (a[i] != ' ') {
return 0;
}
}
return 1;
}
static void static void
atimes(char *ar) atimes(char *ar)
{ {
@ -151,11 +163,13 @@ atimes(char *ar)
if(readn(fd, name, namelen) != namelen) if(readn(fd, name, namelen) != namelen)
break; break;
name[namelen] = 0; name[namelen] = 0;
}else if(memcmp(h.name, "// ", 2) == 0){ /* GNU */ }else if(memcmp(h.name, "// ", 3) == 0){ /* GNU */
/* date, uid, gid, mode all ' ' */ /* date, uid, gid, mode all ' ' */
for(i=2; i<16+12+6+6+8; i++) if(!allspaces(&h.name[3], sizeof(h.name) - 3) ||
if(h.name[i] != ' ') !allspaces(h.date, sizeof(h.date)) || !allspaces(h.uid, sizeof(h.uid)) ||
goto skip; !allspaces(h.gid, sizeof(h.gid)) || !allspaces(h.mode, sizeof(h.mode))){
goto skip;
}
t = atol(h.size); t = atol(h.size);
if(t&01) if(t&01)
t++; t++;
@ -189,7 +203,7 @@ atimes(char *ar)
}else{ }else{
strncpy(name, h.name, sizeof(h.name)); strncpy(name, h.name, sizeof(h.name));
for(i = sizeof(h.name)-1; i > 0 && name[i] == ' '; i--) for(i = sizeof(h.name)-1; i > 0 && name[i] == ' '; i--)
; ;
if(name[i] == '/') /* system V bug */ if(name[i] == '/') /* system V bug */
i--; i--;
name[i+1]=0; name[i+1]=0;