|
 |
1710d3 |
From 05c639c8a0f61da73ca8f1f725f8f5394d8bf15f Mon Sep 17 00:00:00 2001
|
|
|
1710d3 |
From: Jakub Martisko <jamartis@redhat.com>
|
|
|
1710d3 |
Date: Thu, 2 Aug 2018 09:34:18 +0200
|
|
|
1710d3 |
Subject: [PATCH] fix: file name buffer overflow in isoinfo
|
|
|
1710d3 |
|
|
|
1710d3 |
---
|
|
|
1710d3 |
genisoimage/diag/isoinfo.c | 10 ++++++++++
|
|
|
1710d3 |
1 file changed, 10 insertions(+)
|
|
|
1710d3 |
|
|
|
1710d3 |
diff --git a/genisoimage/diag/isoinfo.c b/genisoimage/diag/isoinfo.c
|
|
|
1710d3 |
index 3cc2678..a08141d 100644
|
|
|
1710d3 |
--- a/genisoimage/diag/isoinfo.c
|
|
|
1710d3 |
+++ b/genisoimage/diag/isoinfo.c
|
|
|
1710d3 |
@@ -763,6 +763,11 @@ parse_dir(char *rootname, int extent, int len)
|
|
|
1710d3 |
strcat(td->name, name_buf);
|
|
|
1710d3 |
strcat(td->name, "/");
|
|
|
1710d3 |
} else {
|
|
|
1710d3 |
+ if ( (PATH_MAX - strlen(rootname)) < strlen(name_buf))
|
|
|
1710d3 |
+ {
|
|
|
1710d3 |
+ fprintf(stderr, "Name too long: %s%s\n", rootname, name_buf);
|
|
|
1710d3 |
+ exit(1);
|
|
|
1710d3 |
+ }
|
|
|
1710d3 |
strcpy(testname, rootname);
|
|
|
1710d3 |
strcat(testname, name_buf);
|
|
|
1710d3 |
if (xtract && strcmp(xtract, testname) == 0) {
|
|
|
1710d3 |
@@ -772,6 +777,11 @@ parse_dir(char *rootname, int extent, int len)
|
|
|
1710d3 |
if (do_find &&
|
|
|
1710d3 |
(idr->name_len[0] != 1 ||
|
|
|
1710d3 |
(idr->name[0] != 0 && idr->name[0] != 1))) {
|
|
|
1710d3 |
+ if ( (PATH_MAX - strlen(rootname)) < strlen(name_buf))
|
|
|
1710d3 |
+ {
|
|
|
1710d3 |
+ fprintf(stderr, "Name too long: %s%s\n", rootname, name_buf);
|
|
|
1710d3 |
+ exit(1);
|
|
|
1710d3 |
+ }
|
|
|
1710d3 |
strcpy(testname, rootname);
|
|
|
1710d3 |
strcat(testname, name_buf);
|
|
|
1710d3 |
printf("%s\n", testname);
|
|
|
1710d3 |
--
|
|
|
1710d3 |
2.14.4
|
|
|
1710d3 |
|