diff options
| author | Jim Meyering <meyering@redhat.com> | 2008-03-21 10:37:26 +0100 |
|---|---|---|
| committer | Jim Meyering <meyering@redhat.com> | 2008-03-21 20:58:15 +0100 |
| commit | a0851554bd52038ed47e46ee521ce74a5a09f747 (patch) | |
| tree | 624025f9d2b1e17429bd4934da21942dab3b3039 /NEWS | |
| parent | 4f812540a26ad98b52fac71e54049253359caf19 (diff) | |
| download | coreutils-a0851554bd52038ed47e46ee521ce74a5a09f747.tar.xz | |
ptx: avoid heap overrun for backslash at end of optarg string
* src/ptx.c (copy_unescaped_string): Ignore a lone backslash
at end of string. Reported by Cristian Cadar, Daniel Dunbar
and Dawson Engler. Details here:
<http://thread.gmane.org/gmane.comp.gnu.coreutils.bugs/13005>.
* tests/misc/Makefile.am (TESTS): Add ptx-overrun.
* tests/misc/ptx-overrun: New file. Test for the above fix.
* NEWS: Mention the fix.
Signed-off-by: Jim Meyering <meyering@redhat.com>
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -16,6 +16,11 @@ GNU coreutils NEWS -*- outline -*- when the destination had two or more hard links. It no longer does that. [bug introduced in coreutils-5.3.0] + "ptx -F'\' long-file-name" would overrun a malloc'd buffer and corrupt + the heap. That was triggered by a lone backslash (or odd number of them) + at the end of the option argument to --flag-truncation=STRING (-F), + --word-regexp=REGEXP (-W), or --sentence-regexp=REGEXP (-S). + "rmdir --ignore-fail-on-non-empty" detects and ignores the failure in more cases when a directory is empty. |