From owner-cvs-src-old@FreeBSD.ORG Tue Aug 10 22:47:21 2010 Return-Path: Delivered-To: cvs-src-old@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 834471065674 for ; Tue, 10 Aug 2010 22:47:21 +0000 (UTC) (envelope-from jilles@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 70CFD8FC20 for ; Tue, 10 Aug 2010 22:47:21 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.4/8.14.4) with ESMTP id o7AMlLH5026758 for ; Tue, 10 Aug 2010 22:47:21 GMT (envelope-from jilles@repoman.freebsd.org) Received: (from svn2cvs@localhost) by repoman.freebsd.org (8.14.4/8.14.4/Submit) id o7AMlLub026757 for cvs-src-old@freebsd.org; Tue, 10 Aug 2010 22:47:21 GMT (envelope-from jilles@repoman.freebsd.org) Message-Id: <201008102247.o7AMlLub026757@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to jilles@repoman.freebsd.org using -f From: Jilles Tjoelker Date: Tue, 10 Aug 2010 22:45:59 +0000 (UTC) To: cvs-src-old@freebsd.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/bin/sh expand.c src/tools/regression/bin/sh/expansion pathname3.0 X-BeenThere: cvs-src-old@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: **OBSOLETE** CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Aug 2010 22:47:21 -0000 jilles 2010-08-10 22:45:59 UTC FreeBSD src repository Modified files: bin/sh expand.c Added files: tools/regression/bin/sh/expansion pathname3.0 Log: SVN rev 211155 on 2010-08-10 22:45:59Z by jilles sh: Fix heap-based buffer overflow in pathname generation. The buffer for generated pathnames could be too small in some cases. It happened to be always at least PATH_MAX long, so there was never an overflow if the resulting pathnames would be usable. This bug may be abused if a script subjects input from an untrusted source to pathname generation, which a bad idea anyhow. Most shell scripts do not work on untrusted data. secteam@ says no advisory is necessary. PR: bin/148733 Reported by: Changming Sun snnn119 at gmail com MFC after: 10 days Revision Changes Path 1.66 +15 -16 src/bin/sh/expand.c 1.1 +29 -0 src/tools/regression/bin/sh/expansion/pathname3.0 (new)