Re: [patch] Fix for BZ #18043 buffer-overflow (read past the end) in wordexp/parse_dollars/parse_param

[Paul Pluzhnikov <ppluzhnikov at gmail dot com>]

On Thu, Mar 5, 2015 at 11:48 AM, Carlos O'Donell <carlos@redhat.com> wrote:

> OK to commit as long as you verified that test case fails before
> and passes afterwards on at least x86_64.

It doesn't. To make it fail I would have to mmap two pages, mprotect
the second, and place the string at the end of the first page... which
is quite a bit of code.

Must I do that? I guess if we hope to catch any regression here, I must...

Attached patch is verified to fail posix/wordexp-test with expected
SIGSEGV due to overflow before the fix, and pass after.


2015-03-05  Paul Pluzhnikov  <ppluzhnikov@google.com>

        [BZ #18043]
        * posix/wordexp.c (parse_param): Fix buffer overflow.
        * posix/wordexp-test.c (do_bz18043): Add test case.



-- 
Paul Pluzhnikov

Attachment: bz18043.patch2.txt
Description: Text document