Bug 62932 (CVE-2004-1010)

* This comment was added by mail.
----- Forwarded message from Josh Bressers <bressers@redhat.com> -----

Date: Fri, 5 Nov 2004 16:00:58 -0500
From: Josh Bressers <bressers@redhat.com>
To: martin.pitt@canonical.com
Cc: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
Subject: Re: [Full-Disclosure] [HV-MED] Zip/Linux long path buffer overflow

On Fri, Nov 05, 2004 at 02:26:33PM +0100, Martin Pitt wrote:
| I prepared a small fix for this (see below). It does not make zip work
| with long file names, but at least it exits cleanly with giving the
| reason, and does not segfault.

This fix will allow zip to create an archive with very long filenames.

I'm also changing the type of len from a signed int to size_t to prevent
trouble in the future.

--- zip-2.3/unix/unix.c.orig    2004-11-05 15:44:41.000000000 -0500
+++ zip-2.3/unix/unix.c 2004-11-05 15:50:28.000000000 -0500
    a file size of -1 */
 {
   struct stat s;        /* results of stat() */
-  char name[FNMAX];
-  int len = strlen(f);
+  char *name;
+  size_t len = strlen(f);
 
   if (f == label) {
     if (a != NULL)
       t->atime = t->mtime = t->ctime = label_utim;
     return label_time;
   }
+
+  name = malloc(len+1);
+  if (!name)
+    return 0;
+
   strcpy(name, f);
   if (name[len - 1] == '/')
     name[len - 1] = '\0';

Does the fix apply?
Shall I make patchinfo files?

CAN-2004-1010 

The patch applies and compiles both on SLES8 and SLES9.
Please provide patchinfos.

For testing it I would like to have a way to create a directory with 256
characters in bash. But regardless of the file system (reiser, ext2 or ext3),
mkdir won't let me because the "file name is too long".

What's the trick ? Or I have to use C for that ?

I used something like:

DIRNAME=$(perl -e ' print "a" x 256 ; ')
moonraker:~ # mkdir $DIRNAME
mkdir: cannot create directory
`aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa':
File name too long

A file name can be max 255 characters but a path can have max 4096 characters.   
Try this: 
 
perl -e '$i=10;while($i){$fn="x"x255;mkdir $fn; chdir$fn;--$i}' 

Got it ;)

Please provide patchinfos.

Fixed and commited to all of is_maintained and is_maintained -b (including
patchinfos).

<!-- SBZ_reopen -->Reopened by meissner@suse.de at Fri Nov 12 13:07:07 2004, took initial reporter lnussel@suse.de to cc

reopen for tracking 

swamp_id: 22 

Hmm, the patch contains a malloc but no free. Looks like a memory leak.
Please fix.

Hello? Nobody listening?

thomas@bragg:~> tel rommel 
------------------------------------------------------------ 
Name       : Heiko Rommel 
Login      : rommel 
Phone      : +49-911-740 53 - 696 
Mobile     : 0179 5977 815 
Department : [RD-QA] Quality Assurance 
Position   : Employee 
Location   : Maxtorhof, Room 2.2.10 
Tasks      : DNS, News and Mail 
             mailing lists 
             SLOX based groupware/GW migration 
             IT documentation 
             print server 
             a few packages from the distribution (mainly mail/news stuff) 
Absent     : Mon 2004-11-15 - Fri 2004-11-19 
             Wed 2004-12-22 - Fri 2004-12-31 
             Fri 2004-12-24 
             Fri 2004-12-31 
------------------------------------------------------------ 
 
Heiko was away last week. 
 

Still nobody listening?

Date: Tue, 30 Nov 2004 11:12:32 +0100 
From: rommel@suse.de 
To: thomas@suse.de 
Subject: Re: Bug 62932 
Auto-Submitted: auto-replied (vacation) 
 
I'm out of the office until 2004/12/1. 
 
- 
 
Ich bin bis einschliesslich 1.12.2004 abwesend. 

Sorry, for the trouble my absence is causing these days.
If not already done, I'm going to start to work on it at 14:00 today.

Reworked the patch. Starting to re-commit at 16:00 CET.

--- unix/unix.c
+++ unix/unix.c
@@ -324,8 +324,9 @@
    a file size of -1 */
 {
   struct stat s;        /* results of stat() */
-  char name[FNMAX];
-  int len = strlen(f);
+  char *name;
+  size_t len = strlen(f);
+
 
   if (f == label) {
     if (a != NULL)
@@ -336,19 +337,30 @@
       t->atime = t->mtime = t->ctime = label_utim;
     return label_time;
   }
+
+  name = malloc(len+1);
+  if (!name)
+    return 0;
+
   strcpy(name, f);
   if (name[len - 1] == '/')
     name[len - 1] = '\0';
   /* not all systems allow stat'ing a file with / appended */
   if (strcmp(f, "-") == 0) {
-    if (fstat(fileno(stdin), &s) != 0)
+    if (fstat(fileno(stdin), &s) != 0) {
+      free(name);
       error("fstat(stdin)");
+    }
   }
-  else if (LSSTAT(name, &s) != 0)
+  else if (LSSTAT(name, &s) != 0) {
     /* Accept about any file kind including directories
      * (stored with trailing / with -r option)
      */
+    free(name);
     return 0;
+  }
+
+  free(name);
 
   if (a != NULL) {
 #ifndef OS390

Fixed in STABLE is_maintained.

<!-- SBZ_reopen -->Reopened by meissner@suse.de at Fri Dec  3 11:52:41 2004

reopen for tracking 

patchinfos checked in now. 

packages approved. 

CVE-2004-1010: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)