Attachment 148861 Details for Bug 229191 – patch fixing buffer overflow on 64bit systems for cpio-2.5

[patch] patch fixing buffer overflow on 64bit systems for cpio-2.5

cpio-2.5-writeOutBufOverflow.patch (text/plain), 1.15 KB, created by Lukas Vrabel on 2007-02-27 13:42:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lukas Vrabel

Created: 2007-02-27 13:42:24 UTC

Size: 1.15 KB

patch

obsolete

>--- cpio-2.5/copyout.c.writeOutBufOverflow	2007-02-23 19:05:06.000000000 +0100
>+++ cpio-2.5/copyout.c	2007-02-23 20:26:54.000000000 +0100
>@@ -53,6 +53,15 @@
> 	magic_string = "070702";
>       else
> 	magic_string = "070701";
>+
>+      // check filesize to prevent buffer overflow on 64 bit systems
>+      if(file_hdr->c_filesize > 0xFFFFFFFF)
>+        {
>+        error (1, 0, "%s: field width not sufficient for storing filesize",
>+               file_hdr->c_name);
>+        }
>+
>+
>       sprintf (ascii_header,
> 	       "%6s%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx",
> 	       magic_string,
>@@ -111,6 +120,11 @@
>       if ((file_hdr->c_ino >> 16) != 0)
> 	error (0, 0, "%s: truncating inode number", file_hdr->c_name);
> 
>+      // check filesize to prevent buffer overflow
>+      if(file_hdr->c_filesize > 0xFFFFFFFF)
>+         error (1, 0, "%s: field width not sufficient for storing filesize",
>+                file_hdr->c_name);
>+
>       /* Debian hack: The type of dev_t has changed in glibc.  Fixed output
>          to ensure that a long int is passed to sprintf.  This has been
>          reported to "bug-gnu-utils@prep.ai.mit.edu". (1998/5/26) -BEM */

Actions: View | Diff

Attachments on bug 229191: 148861