mirrors/tar
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Diagnose argp overflow

Browse Source 
* src/names.c (handle_option):
* src/tar.c (parse_default_options):
Report an error if wordsplitting yields more than INT_MAX words,
rather than misbehaving.  argp_parse can’t handle more than
INT_MAX, unfortunately.
This commit is contained in:
Paul Eggert
2024-08-03 11:55:39 -07:00
parent 9cef4d5495
commit dab2830e38
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/names.c
View File

@@ -988,7 +988,6 @@ static int
handle_option (const char *str, struct name_elt const *ent)
{
struct wordsplit ws;
int i;
struct option_locus loc;
while (*str && c_isspace (*str))
@@ -1000,14 +999,15 @@ handle_option (const char *str, struct name_elt const *ent)
if (wordsplit (str, &ws, WRDSF_DEFFLAGS|WRDSF_DOOFFS))
FATAL_ERROR ((0, 0, _("cannot split string '%s': %s"),
str, wordsplit_strerror (&ws)));
int argc;
if (ckd_add (&argc, ws.ws_wordc, ws.ws_offs))
FATAL_ERROR ((0, 0, _("too many options")));
ws.ws_wordv[0] = (char *) program_name;
loc.source = OPTS_FILE;
loc.name = ent->v.file.name;
loc.line = ent->v.file.line;
more_options (ws.ws_wordc+ws.ws_offs, ws.ws_wordv, &loc);
for (i = 0; i < ws.ws_wordc+ws.ws_offs; i++)
ws.ws_wordv[i] = NULL;
more_options (argc, ws.ws_wordv, &loc);
memset (ws.ws_wordv, 0, argc * sizeof *ws.ws_wordv);
wordsplit_free (&ws);
return 0;
}

9
src/tar.c
View File

@@ -2387,10 +2387,11 @@ parse_default_options (struct tar_args *args)
ws.ws_wordv[0] = (char*) program_name;
save_loc_ptr = args->loc;
args->loc = &loc;
if (argp_parse (&argp,
ws.ws_offs + ws.ws_wordc,
ws.ws_wordv,
ARGP_IN_ORDER|ARGP_NO_EXIT, &idx, args))
int argc;
if (ckd_add (&argc, ws.ws_offs, ws.ws_wordc))
FATAL_ERROR ((0, 0, "too many options"));
if (argp_parse (&argp, argc, ws.ws_wordv,
ARGP_IN_ORDER | ARGP_NO_EXIT, &idx, args))
abort (); /* shouldn't happen */
args->loc = save_loc_ptr;
if (name_more_files ())