Package: yafc
Version: 1.3.5-2
Severity: important
Tags: upstream patch

Dear maintainer,

There is a bug in the path shortener that makes yafc crash on some
specific input.

When it tries to replace a short directory name with "..." it tries to
push the remaining of the string farther away, without reallocating a
larger buffer.

For instance:
/w/some/very/long/pathname/whichis/really/too/long/andshouldbeshortened.html
is likely to cause the bug.

The actual bug is in src/libmhe/shortpath.c when using strpush.

I propose here a patch that simplifies the path shortening code so that
it has no loop, no complex condition, no temporary memory allocation, no
complex string handling.

In short: half the size, twice the fun. :)

The patch hasn't been extensively tested, but I guess it should be
bug-free and behave like the original code.


Best regards,
Celelibi

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 
'experimental')
Architecture: i386 (x86_64)

Kernel: Linux 3.10.11 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: sysvinit (via /sbin/init)

Versions of packages yafc depends on:
ii  libbsd0               0.7.0-2
ii  libc6                 2.19-17
ii  libedit2              3.1-20140620-2
ii  libgssapi3-heimdal    1.6~rc2+dfsg-9
ii  libhcrypto4-heimdal   1.6~rc2+dfsg-9
ii  libheimbase1-heimdal  1.6~rc2+dfsg-9
ii  libroken18-heimdal    1.6~rc2+dfsg-9
ii  libssh-4              0.6.3-4

yafc recommends no packages.

yafc suggests no packages.

-- no debconf information
>From c92ae6cbae92dab0bdf996270c73e93442b5b54f Mon Sep 17 00:00:00 2001
From: Celelibi <[email protected]>
Date: Mon, 6 Apr 2015 22:31:32 +0200
Subject: [PATCH] shortpath: simpler code

Signed-off-by: Celelibi <[email protected]>
---
 src/libmhe/shortpath.c | 64 +++++++++++++++++---------------------------------
 1 file changed, 21 insertions(+), 43 deletions(-)

diff --git a/src/libmhe/shortpath.c b/src/libmhe/shortpath.c
index 12a46d7..cb9883d 100644
--- a/src/libmhe/shortpath.c
+++ b/src/libmhe/shortpath.c
@@ -22,54 +22,32 @@
  * /usr/bin/averylongfilenamethatistoolongindeed.tar.gz => /...oolongindeed.tar.gz
  */
 
-static char* chop(const char *str, size_t maxlen)
-{
-	const size_t len = strlen(str);
+static char *_shortpath(char *path, size_t maxlen) {
+	size_t len = strlen(path);
+	char *result = NULL;
+	char *copy_from = NULL;
+	char *first_slash = NULL;
+	size_t start_len = 0;
+
 	if (len <= maxlen)
-		return xstrdup(str);
+		return xstrdup(path);
 
-	char* result = malloc(maxlen + 1);
-	strncpy(result, "...", 3);
-	strncpy(result + 3, str+(len-maxlen+3), maxlen - 3);
-	result[maxlen] = '\0';
-	return result;
-}
+	result = xmalloc(maxlen + 1);
 
-static char* dirtodots(const char *path, size_t maxlen)
-{
-	const char* first_slash = strchr(path, '/');
-	if (!first_slash)
-		return chop(path, maxlen);
-
-	const char* end_slash = NULL;
-	if (strncmp(first_slash+1, "...", 3) == 0)
-		end_slash = strchr(first_slash+5, '/');
-	else
-		end_slash = strchr(first_slash+1, '/');
-
-	if (!end_slash)
-		return chop(path, maxlen);
-
-	size_t first = first_slash - path,
-				 end = end_slash - path;
-	char* result = xstrdup(path);
-	if (end - first < 4) /* /fu/ */
-		strpush(result + first +1, 4 - (end - first));
-	else /* /foobar/ */
-		strcpy(result + first + 4, end_slash);
-	strncpy(result + first + 1, "...", 3);
-	return result;
-}
+	first_slash = strchr(path, '/');
+	if (first_slash)
+		start_len = first_slash - path + 1;
 
-static char *_shortpath(char *path, size_t maxlen)
-{
-	const size_t len = strlen(path);
-	if (len <= maxlen)
-		return xstrdup(path);
+	strncpy(result, path, start_len);
+	strcpy(result + start_len, "...");
+	start_len += 3;
+
+	copy_from = strchr(path + (len - 1) - (maxlen - start_len), '/');
+	if (!copy_from)
+		copy_from = path + (len - 1) - (maxlen - start_len);
+
+	strcpy(result + start_len, copy_from);
 
-	char* tmp = dirtodots(path, maxlen);
-	char* result = _shortpath(tmp, maxlen);
-	free(tmp);
 	return result;
 }
 
-- 
2.1.4

Reply via email to