GNU logs - #39165, boring messages

Message sent to bug-sed@HIDDEN:

Subject: bug#39165: [PATCH] sed: handle very long execution lines
Resent-From: Tobias Stoeckmann <tobias@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-sed@HIDDEN
Resent-Date: Fri, 17 Jan 2020 20:50:01 +0000
Resent-Message-ID: <handler.39165.B.157929419124618 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 39165 <at> debbugs.gnu.org
Date: Fri, 17 Jan 2020 20:49:33 +0100
From: Tobias Stoeckmann <tobias@HIDDEN>
Message-ID: <20200117194933.ribsxwlyuqrr7kft@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

If sed is called with an excessively long execution line, then it is
prone to an out of boundary memory access.

The problem is that the length of the execution line, which is a
size_t, is temporarily stored in an int. This means that on systems
which have a 64 bit size_t and a 32 bit int (e.g. linux amd64) an
execution line which exceeds 2 GB will overflow int. If it is just
slightly larger than 2 GB, the negative int value is used as an
array index to finish the execution line string with '\0' which
therefore triggers the out of boundary access.

This problem is probably never triggered in reality, but can be
provoked like this (given that 'e' support is compiled in):

$ dd if=/dev/zero bs=1M count=2049 | tr '\0' 'e' > e-command.txt
$ sed -f e-command.txt /etc/fstab
Segmentation fault (core dumped)
$ _

While at it, I also adjusted another int/size_t conversion, even
though it is a purely cosmetical change, because it can never be
larger than 4096.

Signed-off-by: Tobias Stoeckmann <tobias@HIDDEN>
---
 sed/execute.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sed/execute.c b/sed/execute.c
index c5f07cc..8f43f2e 100644
--- a/sed/execute.c
+++ b/sed/execute.c
@@ -1347,7 +1347,7 @@ execute_program (struct vector *vec, struct input *input)
               panic (_("`e' command not supported"));
 #else
               FILE *pipe_fp;
-              int cmd_length = cur_cmd->x.cmd_txt.text_length;
+              size_t cmd_length = cur_cmd->x.cmd_txt.text_length;
               line_reset (&s_accum, NULL);

               if (!cmd_length)
@@ -1367,7 +1367,7 @@ execute_program (struct vector *vec, struct input *input)

               {
                 char buf[4096];
-                int n;
+                size_t n;
                 while (!feof (pipe_fp))
                   if ((n = fread (buf, sizeof (char), 4096, pipe_fp)) > 0)
                     {
-- 
2.25.0

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Tobias Stoeckmann <tobias@HIDDEN>
Subject: bug#39165: Acknowledgement ([PATCH] sed: handle very long
 execution lines)
Message-ID: <handler.39165.B.157929419124618.ack <at> debbugs.gnu.org>
References: <20200117194933.ribsxwlyuqrr7kft@localhost>
X-Gnu-PR-Message: ack 39165
X-Gnu-PR-Package: sed
X-Gnu-PR-Keywords: patch
Reply-To: 39165 <at> debbugs.gnu.org
Date: Fri, 17 Jan 2020 20:50:01 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-sed@HIDDEN

If you wish to submit further information on this problem, please
send it to 39165 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
39165: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D39165
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Last modified: Fri, 17 Jan 2020 21:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.