kc3-lang/pkgconf/libpkgconf/fileio.c

Tag - branch -master- tag -pkgconf-2.5.1pkgconf-2.5.0pkgconf-2.4.3pkgconf-2.4.2pkgconf-2.4.1pkgconf-2.4.0pkgconf-2.3.0pkgconf-2.2.0pkgconf-2.1.1pkgconf-2.1.0pkgconf-2.0.3pkgconf-2.0.2pkgconf-2.0.1pkgconf-2.0.0pkgconf-1.9.5pkgconf-1.9.4pkgconf-1.9.3pkgconf-1.9.2pkgconf-1.9.1pkgconf-1.9.0pkgconf-1.8.0pkgconf-1.7.4pkgconf-1.7.3pkgconf-1.7.2pkgconf-1.7.1pkgconf-1.7.0pkgconf-1.6.3pkgconf-1.6.2pkgconf-1.6.1pkgconf-1.6.0pkgconf-1.5.4pkgconf-1.5.3pkgconf-1.5.2pkgconf-1.5.1pkgconf-1.4.2pkgconf-1.4.1pkgconf-1.4.0pkgconf-1.3.90pkgconf-1.3.7pkgconf-1.3.6pkgconf-1.3.5pkgconf-1.3.4pkgconf-1.3.3pkgconf-1.3.2pkgconf-1.3.1pkgconf-1.3.0pkgconf-1.2.0pkgconf-1.1.0pkgconf-1.0.1pkgconf-1pkgconf-0.9.9pkgconf-0.9.8pkgconf-0.9.7pkgconf-0.9.6pkgconf-0.9.5pkgconf-0.9.4pkgconf-0.9.3pkgconf-0.9.2pkgconf-0.9.12pkgconf-0.9.11pkgconf-0.9.10pkgconf-0.9.1pkgconf-0.9.0pkgconf-0.8.9pkgconf-0.8.8pkgconf-0.8.7pkgconf-0.8.4pkgconf-0.8.3pkgconf-0.8.2pkgconf-0.8.12pkgconf-0.8.11pkgconf-0.8.10pkgconf-0.8.1pkgconf-0.8pkgconf-0.7pkgconf-0.6pkgconf-0.5.3pkgconf-0.5.2pkgconf-0.5.1pkgconf-0.5pkgconf-0.4pkgconf-0.3pkgconf-0.2pkgconf-0.1.1pkgconf-0.1

• Show log

  Commit

• Hash : bd4ed1ca
  Author :
  Date : 2020-05-24T20:51:48
  

  libpkgconf: fileio: prevent buffer overflow.
  
  pkgconf_fgetline is called with a user-defined buffer, its size, and
  a FILE stream to read input from.
  
  If the buffer is almost completely filled and the file stream contains
  an escaped character, then it is possible to trigger an off-by-one
  buffer overflow with a '\0' character.
  
  Easiest example to trigger this:
  
  char buf[2];
  pkgconf_fgetline(buf, sizeof(buf), stdin);
  
  Enter "\\" (two backslashes) and press enter. If the library and the
  program are compiled with address sanitizer, you will see the program
  crashing. Otherwise it depends on your architecture what happens.
  
  Since nobody should be using a buffer of only size 1 or 2, keep enough
  space for a possibly escaped character in while loop by subtracting one
  more byte for this situation, not just for '\0'.
  

Download

• libpkgconf/fileio.c

• /*
   * fileio.c
   * File reading utilities
   *
   * Copyright (c) 2012 pkgconf authors (see AUTHORS).
   *
   * Permission to use, copy, modify, and/or distribute this software for any
   * purpose with or without fee is hereby granted, provided that the above
   * copyright notice and this permission notice appear in all copies.
   *
   * This software is provided 'as is' and without any warranty, express or
   * implied.  In no event shall the authors be liable for any damages arising
   * from the use of this software.
   */
  
  #include <libpkgconf/stdinc.h>
  #include <libpkgconf/libpkgconf.h>
  
  char *
  pkgconf_fgetline(char *line, size_t size, FILE *stream)
  {
  	char *s = line;
  	char *end = line + size - 2;
  	bool quoted = false;
  	int c = '\0', c2;
  
  	if (s == NULL)
  		return NULL;
  
  	while (s < end && (c = getc(stream)) != EOF)
  	{
  		if (c == '\\' && !quoted)
  		{
  			quoted = true;
  			continue;
  		}
  		else if (c == '#')
  		{
  			if (!quoted) {
  				/* Skip the rest of the line */
  				do {
  					c = getc(stream);
  				} while (c != '\n' && c != EOF);
  				*s++ = c;
  				break;
  			}
  			quoted = false;
  			continue;
  		}
  		else if (c == '\n')
  		{
  			if (quoted)
  			{
  				/* Trim spaces */
  				do {
  					c2 = getc(stream);
  				} while (c2 == '\t' || c2 == ' ');
  
  				ungetc(c2, stream);
  
  				quoted = false;
  				continue;
  			}
  			else
  			{
  				*s++ = c;
  			}
  
  			break;
  		}
  		else if (c == '\r')
  		{
  			*s++ = '\n';
  
  			if ((c2 = getc(stream)) == '\n')
  			{
  				if (quoted)
  				{
  					quoted = false;
  					continue;
  				}
  
  				break;
  			}
  
  			ungetc(c2, stream);
  
  			if (quoted)
  			{
  				quoted = false;
  				continue;
  			}
  
  			break;
  		}
  		else
  		{
  			if (quoted) {
  				*s++ = '\\';
  				quoted = false;
  			}
  			*s++ = c;
  		}
  
  	}
  
  	if (c == EOF && (s == line || ferror(stream)))
  		return NULL;
  
  	*s = '\0';
  
  	/* Remove newline character. */
  	if (s > line && *(--s) == '\n') {
  		*s = '\0';
  
  		if (s > line && *(--s) == '\r')
  			*s = '\0';
  	}
  
  	return line;
  }
  

Download