[PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines

[PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines

[Tiago de Paula]

Update lleft before calling preadfd so buffered data is preserved
when refilling the buffer during long line scanning, preventing
out-of-bounds reads.

Fixes: a065467315dc ("input: Move newline loop into preadbuffer")
Signed-off-by: Tiago de Paula <tiagodepalves@gmail.com>
---
I discovered this via perlbrew: config.sh contained a single
'cppsymbols=...' line that was 12502 characters long. The issue
can be replicated with:

    python -c 'print("VAR=" + "a"*8300)' > repro.sh
    dash repro.sh

AddressSanitizer reports a heap-buffer-overflow in preadbuffer(),
which led to me this fix.

 src/input.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/input.c b/src/input.c
index c36d120..3467bd1 100644
--- a/src/input.c
+++ b/src/input.c
@@ -386,6 +386,7 @@ eof:

 again:
 		nr = q - parsefile->nextc;
+		input_set_lleft(parsefile, nr);
 		more = preadfd();
 		q = parsefile->nextc + nr;
 		if (more <= 0) {
-- 
2.53.0

Re: [PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines

[Herbert Xu]

Tiago de Paula <tiagodepalves@gmail.com> wrote:
> Update lleft before calling preadfd so buffered data is preserved
> when refilling the buffer during long line scanning, preventing
> out-of-bounds reads.
> 
> Fixes: a065467315dc ("input: Move newline loop into preadbuffer")
> Signed-off-by: Tiago de Paula <tiagodepalves@gmail.com>
> ---
> I discovered this via perlbrew: config.sh contained a single
> 'cppsymbols=...' line that was 12502 characters long. The issue
> can be replicated with:
> 
>    python -c 'print("VAR=" + "a"*8300)' > repro.sh
>    dash repro.sh
> 
> AddressSanitizer reports a heap-buffer-overflow in preadbuffer(),
> which led to me this fix.
> 
> src/input.c | 1 +
> 1 file changed, 1 insertion(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt