Open
file: NUL terminate CDF directory name passed to cdf_app_to_mime() #91
liu-haodong142Add on 9 days ago
file: NUL terminate CDF directory name passed to cdf_app_to_mime() #91
Open
Total: 2 files changed+42-1
| @@ -0,0 +1,36 @@ | |||
| 1 | +From 029e5bae7362e71671b3e1f316d4f3936d8a7819 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Christos Zoulas <christos@zoulas.com> | ||
| 3 | +Date: Tue, 13 Oct 2026 15:54:12 +0000 | ||
| 4 | +Subject: [PATCH] PR/812: mgl: NUL terminate string passed to cdf_app_to_mime() | ||
| 5 | + | ||
| 6 | +(backported from commit 029e5bae7362e71671b3e1f316d4f3936d8a7819) | ||
| 7 | + | ||
| 8 | +Reference: https://github.com/file/file/commit/029e5bae7362e71671b3e1f316d4f3936d8a7819 | ||
| 9 | +--- | ||
| 10 | + src/readcdf.c | 6 +++--- | ||
| 11 | + 1 file changed, 3 insertions(+), 2 deletions(-) | ||
| 12 | + | ||
| 13 | +diff --git a/src/readcdf.c b/src/readcdf.c | ||
| 14 | +index 30c3d246..19a44146 100644 | ||
| 15 | +--- a/src/readcdf.c | ||
| 16 | ++++ b/src/readcdf.c | ||
| 17 | +@@ -392,7 +392,7 @@ | ||
| 18 | + int i; | ||
| 19 | + const char *str = NULL; | ||
| 20 | + cdf_directory_t *d; | ||
| 21 | +- char name[__arraycount(d->d_name)]; | ||
| 22 | ++ char name[__arraycount(d->d_name) + 1]; | ||
| 23 | + size_t j, k; | ||
| 24 | + | ||
| 25 | + #ifdef CDF_DEBUG | ||
| 26 | +@@ -406,8 +406,9 @@ | ||
| 27 | + return i; | ||
| 28 | + for (j = 0; str == NULL && j < dir->dir_len; j++) { | ||
| 29 | + d = &dir->dir_tab[j]; | ||
| 30 | +- for (k = 0; k < sizeof(name); k++) | ||
| 31 | ++ for (k = 0; k < sizeof(name) - 1; k++) | ||
| 32 | + name[k] = CAST(char, cdf_tole2(d->d_name[k])); | ||
| 33 | ++ name[sizeof(name) - 1] = '\0'; | ||
| 34 | + str = cdf_app_to_mime(name, | ||
| 35 | + NOTMIME(ms) ? name2desc : name2mime); | ||
| 36 | + } | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: file | 1 | Name: file |
| 2 | Version: 5.45 | 2 | Version: 5.45 |
| 3 | -Release: 5 | 3 | +Release: 6 |
| 4 | Summary: A tool to identify the type of a particular file type | 4 | Summary: A tool to identify the type of a particular file type |
| 5 | License: BSD | 5 | License: BSD |
| 6 | URL: http://www.darwinsys.com/file/ | 6 | URL: http://www.darwinsys.com/file/ |
| @@ -8,6 +8,7 @@ Source0: ftp://ftp.astron.com/pub/file/file-%{version}.tar.gz | |||
| 8 | 8 | ||
| 9 | Patch1: 0001-file-localmagic.patch | 9 | Patch1: 0001-file-localmagic.patch |
| 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch | 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch |
| 11 | +Patch3: backport-cdf-name-nul-terminate.patch | ||
| 11 | 12 | ||
| 12 | Requires: %{name}-libs = %{version}-%{release} | 13 | Requires: %{name}-libs = %{version}-%{release} |
| 13 | BuildRequires: autoconf automake libtool zlib-devel make | 14 | BuildRequires: autoconf automake libtool zlib-devel make |
| @@ -134,6 +135,10 @@ make -C tests check | |||
| 134 | %{python3_sitelib}/__pycache__/* | 135 | %{python3_sitelib}/__pycache__/* |
| 135 | 136 | ||
| 136 | %changelog | 137 | %changelog |
| 138 | +* Wed Oct 28 2026 liu-haodong142 <dev03108@linx-info.com> - 5.45-6 | ||
| 139 | +- Backport upstream fix to NUL terminate the CDF directory name passed to | ||
| 140 | + cdf_app_to_mime(), preventing a stack out-of-bounds read | ||
| 141 | + | ||
| 137 | * Thu Jul 16 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 | 142 | * Thu Jul 16 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 |
| 138 | - Prevent incorrect result for nbytes > 2GB | 143 | - Prevent incorrect result for nbytes > 2GB |
| 139 | 144 | ||