Blame rsync-3.0.7-buf-overflow.patch
|
Jan Zeleny |
cab04a2 |
index 7139b10..fef15aa 100644
|
|
Jan Zeleny |
cab04a2 |
--- a/flist.c
|
|
Jan Zeleny |
cab04a2 |
+++ b/flist.c
|
|
Jan Zeleny |
cab04a2 |
@@ -1640,21 +1640,29 @@ static void send_directory(int f, struct file_list *flist, char *fbuf, int len,
|
|
Jan Zeleny |
cab04a2 |
}
|
|
Jan Zeleny |
f8f6d39 |
|
|
Jan Zeleny |
cab04a2 |
p = fbuf + len;
|
|
Jan Zeleny |
cab04a2 |
- if (len != 1 || *fbuf != '/')
|
|
Jan Zeleny |
cab04a2 |
+ if (len == 1 && *fbuf == '/')
|
|
Jan Zeleny |
cab04a2 |
+ remainder = MAXPATHLEN - 1;
|
|
Jan Zeleny |
cab04a2 |
+ else if (len < MAXPATHLEN-1) {
|
|
Jan Zeleny |
cab04a2 |
*p++ = '/';
|
|
Jan Zeleny |
cab04a2 |
- *p = '\0';
|
|
Jan Zeleny |
cab04a2 |
- remainder = MAXPATHLEN - (p - fbuf);
|
|
Jan Zeleny |
cab04a2 |
+ *p = '\0';
|
|
Jan Zeleny |
cab04a2 |
+ remainder = MAXPATHLEN - (len + 1);
|
|
Jan Zeleny |
cab04a2 |
+ } else
|
|
Jan Zeleny |
cab04a2 |
+ remainder = 0;
|
|
Jan Zeleny |
cab04a2 |
|
|
Jan Zeleny |
cab04a2 |
for (errno = 0, di = readdir(d); di; errno = 0, di = readdir(d)) {
|
|
Jan Zeleny |
cab04a2 |
char *dname = d_name(di);
|
|
Jan Zeleny |
cab04a2 |
if (dname[0] == '.' && (dname[1] == '\0'
|
|
Jan Zeleny |
cab04a2 |
|| (dname[1] == '.' && dname[2] == '\0')))
|
|
Jan Zeleny |
cab04a2 |
continue;
|
|
Jan Zeleny |
cab04a2 |
- if (strlcpy(p, dname, remainder) >= remainder) {
|
|
Jan Zeleny |
cab04a2 |
+ unsigned name_len = strlcpy(p, dname, remainder);
|
|
Jan Zeleny |
cab04a2 |
+ if (name_len >= remainder) {
|
|
Jan Zeleny |
cab04a2 |
+ char save = fbuf[len];
|
|
Jan Zeleny |
cab04a2 |
+ fbuf[len] = '\0';
|
|
Jan Zeleny |
cab04a2 |
io_error |= IOERR_GENERAL;
|
|
Jan Zeleny |
cab04a2 |
rprintf(FERROR_XFER,
|
|
Jan Zeleny |
cab04a2 |
- "cannot send long-named file %s\n",
|
|
Jan Zeleny |
cab04a2 |
- full_fname(fbuf));
|
|
Jan Zeleny |
cab04a2 |
+ "filename overflows max-path len by %u: %s/%s\n",
|
|
Jan Zeleny |
cab04a2 |
+ name_len - remainder + 1, fbuf, dname);
|
|
Jan Zeleny |
cab04a2 |
+ fbuf[len] = save;
|
|
Jan Zeleny |
cab04a2 |
continue;
|
|
Jan Zeleny |
cab04a2 |
}
|
|
Jan Zeleny |
cab04a2 |
if (dname[0] == '\0') {
|