On 9/23/22 3:24 PM, srobert...@peratonlabs.com wrote:
Bash Version: 5.1
Patch Level: 8
Release Status: release
Description:
Repeatable buffer overflow core-dump in bash's readline
due to rl_forced_update_display trying to zeroize a
string that is not NUL terminated.
Repeat-By:
Create a small window with a new 2x1 bash inside of it.
Resize that window. Type a command. Get a memory error.
Full annotated debugging session showing the
target, smoke, gun, and bullet included below.
Fix:
There may be a second bug which prevents the buffer from being
NUL terminated in the first place, but I urge you to apply
this patch no matter what, since the code as written is very
dangerous without the bounds check.
The bug report was also submitted to the libreadline people
since it still appears to show up there.
--- display.c.orig 2022-09-23 12:23:36.282214239 -0400
+++ display.c 2022-09-23 12:28:17.028118101 -0400
@@ -2644,11 +2644,13 @@
rl_forced_update_display (void)
{
register char *temp;
+ register int templen;
if (visible_line)
{
temp = visible_line;
- while (*temp)
+ templen = vis_lbsize;
+ while (*temp && templen--)
*temp++ = '\0';
}
rl_on_new_line ();
Thanks for the report. This patch isn't the right way to do it; vis_lbsize
is the size of a different buffer (which happens to be the same size, but
still).
It's easier and probably faster to use
memset (visible_line, 0, line_size);
instead of the loop. See if that works for you.
Chet
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU c...@case.edu http://tiswww.cwru.edu/~chet/
