Linux console tools development discussion
 help / color / mirror / Atom feed
* Re: [kbd] [Pkg-kbd-devel] Bug#913252: loadkeys: segmentation fault with a very long file name
  @ 2018-11-09  9:58 ` Andreas Henriksson
  0 siblings, 0 replies; only message in thread
From: Andreas Henriksson @ 2018-11-09  9:58 UTC (permalink / raw)
  To: s3v, 913252; +Cc: Alexey Gladkov, kbd

Control: tags -1 upstream

Hello s3v,

Thanks for your bug report.

On Thu, Nov 08, 2018 at 07:06:36PM +0100, s3v wrote:
> Package: kbd
> Version: 2.0.4-4
> Severity: important

Why important? This seems mostly cosmetical to me so why not minor?

> Dear maintainer,
> loadkeys segfaults with a very long file name and if the "-b" or "-m" option
> was specified:
>  $ foo="0"; for i in {1..6000}; do foo="$foo$i"; done; loadkeys -b $foo
>  segmentation fault
>  $ loadkeys -b $foo
>  segmentation fault

This is caused by calls like these in src/libkeymap/findfile.c :
        strcpy(fp->pathname, filename);

fp->pathname is MAXPATHLEN size and filenames are assumed to fit.
(The oversized filename apparently corrupts argv here which causes
a crash soon after the lk_findfile calls when argv is dereferenced.)

This is done in atleast two places.

Even with that fixed (with strncpy and null-terminating the string)
there are followup bugs, like checking filename/fname rather than
operating on fp->pathname.
Possibly prepending a simple condition like this should prevent
the entire mess:
	if (strlen(filename) >= MAXPATHLEN) return ERR;

Given the situation I'm to lazy to propose a patch. Leaving it up
to whoever decides about which way to go.

Andreas Henriksson

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2018-11-09  9:58 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-09  9:58 ` [kbd] [Pkg-kbd-devel] Bug#913252: loadkeys: segmentation fault with a very long file name Andreas Henriksson

Linux console tools development discussion

This inbox may be cloned and mirrored by anyone:

	git clone --mirror kbd/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kbd kbd/ \
	public-inbox-index kbd

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone