Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-19 Thread enh via Toybox
On Thu, Oct 15, 2020 at 9:22 PM Rob Landley wrote: > > > > On 10/15/20 7:45 PM, enh wrote: > > On Thu, Oct 15, 2020 at 5:21 PM Rob Landley wrote: > >> > >> On 10/14/20 3:21 PM, enh wrote: > >>> i've sent a new fix that just touches dirtree_path() so that it always > >>> honors the size request

Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-15 Thread Rob Landley
On 10/15/20 7:45 PM, enh wrote: > On Thu, Oct 15, 2020 at 5:21 PM Rob Landley wrote: >> >> On 10/14/20 3:21 PM, enh wrote: >>> i've sent a new fix that just touches dirtree_path() so that it always >>> honors the size request again. >> >> Applied, and then cosmetically fiddled with because I

Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-15 Thread enh via Toybox
On Thu, Oct 15, 2020 at 5:21 PM Rob Landley wrote: > > On 10/14/20 3:21 PM, enh wrote: > > i've sent a new fix that just touches dirtree_path() so that it always > > honors the size request again. > > Applied, and then cosmetically fiddled with because I do that. > > >> but I leave for the

Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-15 Thread Rob Landley
On 10/14/20 3:21 PM, enh wrote: > i've sent a new fix that just touches dirtree_path() so that it always > honors the size request again. Applied, and then cosmetically fiddled with because I do that. >> but I leave for the airport to fly back to Japan in 2 hours. (Part of the >> reason I've

Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-14 Thread enh via Toybox
On Wed, Oct 14, 2020 at 1:56 AM Rob Landley wrote: > > On 10/13/20 4:19 PM, enh via Toybox wrote: > > tar was assuming the old behavior of dirtree_path() where there was > > always a spare byte free at the end. > > It's not the old behavior, tar.c is doing: > > i = 1; > name = hname =

Re: [Toybox] [PATCH] tar: fix heap buffer overrun.

2020-10-14 Thread Rob Landley
On 10/13/20 4:19 PM, enh via Toybox wrote: > tar was assuming the old behavior of dirtree_path() where there was > always a spare byte free at the end. It's not the old behavior, tar.c is doing: i = 1; name = hname = dirtree_path(node, ); ... // Consume the 1 extra byte alocated in