Re: [kbd] [Pkg-kbd-devel] Bug#913252: loadkeys: segmentation fault with a very long file name

Re: [kbd] [Pkg-kbd-devel] Bug#913252: loadkeys: segmentation fault with a very long file name

[Andreas Henriksson]

Control: tags -1 upstream

Hello s3v,

Thanks for your bug report.

On Thu, Nov 08, 2018 at 07:06:36PM +0100, s3v wrote:
> Package: kbd
> Version: 2.0.4-4
> Severity: important

Why important? This seems mostly cosmetical to me so why not minor?

> 
> Dear maintainer,
> 
> loadkeys segfaults with a very long file name and if the "-b" or "-m" option
> was specified:
> 
>  $ foo="0"; for i in {1..6000}; do foo="$foo$i"; done; loadkeys -b $foo
>  segmentation fault
> 
>  $ loadkeys -b $foo
>  segmentation fault

This is caused by calls like these in src/libkeymap/findfile.c :
        strcpy(fp->pathname, filename);

fp->pathname is MAXPATHLEN size and filenames are assumed to fit.
(The oversized filename apparently corrupts argv here which causes
a crash soon after the lk_findfile calls when argv is dereferenced.)

This is done in atleast two places.

Even with that fixed (with strncpy and null-terminating the string)
there are followup bugs, like checking filename/fname rather than
operating on fp->pathname.
Possibly prepending a simple condition like this should prevent
the entire mess:
	if (strlen(filename) >= MAXPATHLEN) return ERR;

Given the situation I'm to lazy to propose a patch. Leaving it up
to whoever decides about which way to go.

Regards,
Andreas Henriksson