- From 1f83963f59960150e8c46112daa8411324c1f209 Mon Sep 17 00:00:00 2001

- From: Jiri Slaby <jslaby@suse.cz>

- Date: Fri, 18 Aug 2023 08:26:20 +0200

- Subject: [PATCH] exclude: fix crashes with fortified strlcpy()

- 

- Fortified (-D_FORTIFY_SOURCE=2 for gcc) builds make strlcpy() crash when

- its third parameter (size) is larger than the buffer:

-   $ rsync -FFXHav '--filter=merge global-rsync-filter' Align-37-43/ xxx

-   sending incremental file list

-   *** buffer overflow detected ***: terminated

- 

- It's in the exclude code in setup_merge_file():

-   strlcpy(y, save, MAXPATHLEN);

- 

- Note the 'y' pointer was incremented, so it no longer points to memory

- with MAXPATHLEN "owned" bytes.

- 

- Fix it by remembering the number of copied bytes into the 'save' buffer

- and use that instead of MAXPATHLEN which is clearly incorrect.

- 

- Fixes #511.

- ---

-  exclude.c | 5 +++--

-  1 file changed, 3 insertions(+), 2 deletions(-)

- 

- diff --git a/exclude.c b/exclude.c

- index ffe55b167..1a5de3b9e 100644

- --- a/exclude.c

- +++ b/exclude.c

- @@ -720,7 +720,8 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,

-  	parent_dirscan = True;

-  	while (*y) {

-  		char save[MAXPATHLEN];

- -		strlcpy(save, y, MAXPATHLEN);

- +		/* copylen is strlen(y) which is < MAXPATHLEN. +1 for \0 */

- +		size_t copylen = strlcpy(save, y, MAXPATHLEN) + 1;

-  		*y = '\0';

-  		dirbuf_len = y - dirbuf;

-  		strlcpy(x, ex->pattern, MAXPATHLEN - (x - buf));

- @@ -734,7 +735,7 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,

-  			lp->head = NULL;

-  		}

-  		lp->tail = NULL;

- -		strlcpy(y, save, MAXPATHLEN);

- +		strlcpy(y, save, copylen);

-  		while ((*x++ = *y++) != '/') {}

-  	}

-  	parent_dirscan = False;

- Version: 3.2.7

- Release: 7%{?prerelease}%{?dist}

- Patch2: rsync-3.2.7-buffer-overflow.patch

- %patch 2 -p1 -b .buffer-overflow

- SHA512 (rsync-3.2.7.tar.gz) = c2afba11a352fd88133f9e96e19d6df80eb864450c83eced13a7faa23df947bccf2ef093f2101df6ee30abff4cbbd39ac802e9aa5f726e42c9caff274fad8377

- SHA512 (rsync-patches-3.2.7.tar.gz) = e675f6a3b0f875965b49bb1d655628d646d384e989e93e6d873c86f2c72743c7c8d16e481bc3bd5e9b49ad2c41191acf8d1cb32b2c4394776ce63a3185116743