Re: [Bug-cpio] out-of-bounds write with cpio -i

[Florian Weimer]

On 12/01/2014 02:46 PM, Sergey Poznyakoff wrote:
> +static char *
> +get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
> +{
> +  off_t n = file_hdr->c_filesize + 1;
> +  char *link_name;
> +
> +  if (n == 0 || n > SIZE_MAX)
> +    {
> +      error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
> +      link_name = NULL;
> +    }
> +  else
> +    {
> +      link_name = xmalloc (n);
> +      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
> +      link_name[file_hdr->c_filesize] = '\0';
> +      tape_skip_padding (in_file_des, file_hdr->c_filesize);
> +    }
> +  return link_name;
> +}

Thanks for the patch, but I'm not sure if it is correct.

off_t is signed, so you need to check for out-of-bounds values before 
adding 1 (because signed overflow is undefined), and you also have to 
guard against negative values.

--
Florian Weimer / Red Hat Product Security