Fixes this buffer overflow: https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1a Patch copied from upstream source repository: https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1a From e37b620fe8f14535d737e89a4dcabaed4517bf1a Mon Sep 17 00:00:00 2001 From: Tim Kientzle Date: Sun, 21 Aug 2016 10:51:43 -0700 Subject: [PATCH] Issue #767: Buffer overflow printing a filename The safe_fprintf function attempts to ensure clean output for an arbitrary sequence of bytes by doing a trial conversion of the multibyte characters to wide characters -- if the resulting wide character is printable then we pass through the corresponding bytes unaltered, otherwise, we convert them to C-style ASCII escapes. The stack trace in Issue #767 suggest that the 20-byte buffer was getting overflowed trying to format a non-printable multibyte character. This should only happen if there is a valid multibyte character of more than 5 bytes that was unprintable. (Each byte would get expanded to a four-charcter octal-style escape of the form "\123" resulting in >20 characters for the >5 byte multibyte character.) I've not been able to reproduce this, but have expanded the conversion buffer to 128 bytes on the belief that no multibyte character set has a single character of more than 32 bytes. --- tar/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tar/util.c b/tar/util.c index 9ff22f2..2b4aebe 100644 --- a/tar/util.c +++ b/tar/util.c @@ -182,7 +182,7 @@ safe_fprintf(FILE *f, const char *fmt, ...) } /* If our output buffer is full, dump it and keep going. */ - if (i > (sizeof(outbuff) - 20)) { + if (i > (sizeof(outbuff) - 128)) { outbuff[i] = '\0'; fprintf(f, "%s", outbuff); i = 0; t' value='search'/>
path: root/scripts
AgeCommit message (Expand)Author
2018-06-09pull: Install the new Guix in a profile....* guix/scripts/pull.scm (%pull-version): New variable. (build-from-source): Pass #:pull-version to BUILD. (whole-package-for-legacy, derivation->manifest-entry): New procedure. (build-and-install): Rewrite in terms of 'build-and-use-profile'. * guix/scripts/system.scm (maybe-suggest-running-guix-pull)[latest]: Switch to "/current". * scripts/guix.in (augment-load-paths!): Remove use of ~/.config/guix/latest. * build-aux/compile-as-derivation.scm: Replace "/guix/latest/" with "/current/share/guile/site/X.Y" * guix/scripts.scm (warn-about-old-distro)[age]: Check "/current" instead of "/latest". * doc/guix.texi (Invoking guix pull): Document it. * doc/contributing.texi (Running Guix Before It Is Installed): Remove footnote about abusing ~/.config/guix/latest. Ludovic Courtès
2018-01-28guix: Let Emacs detect “scripts/guix.in” appropriate mode....Since commit 6f774d481839f87178c5895ac2d661e141f879b8 which introduces the use of Guile's meta switch in “scripts/guix.in”, Emacs was not using ‘scheme-mode’ for this file. * scripts/guix.in: Replace "-*- scheme -*-" with a local variable. Signed-off-by: Ludovic Courtès <ludo@gnu.org> Mathieu Lirzin
2018-01-23guix: Refactor script....* scripts/guix.in: Remove empty surrounding ‘let’. Define 'main' as the procedure called when running the script. (maybe-augment-load-paths!): Rename to ... (augment-load-paths!): ... this. Use 'and=>' for 'file-exists?'. (run-guix-main): Rename to ... (main): ... this. Call 'augment-load-paths!'. Signed-off-by: Ludovic Courtès <ludo@gnu.org> Mathieu Lirzin
2018-01-23build: Expand ‘scripts/guix’ at Make time....This moves the complexity of Autotools variable expansion outside of the application code. * scripts/guix.in (config-lookup): Delete. (maybe-augment-load-paths!, run-guix-main): Use fully expanded variables instead of calling ‘config-lookup’. * configure.ac: Don't use AC_CONFIG_FILES for ‘scripts/guix’. Use AC_PROG_SED. * Makefile.am (scripts/guix): New rule. (do_subst): New variable. (CLEANFILES, EXTRA_DIST): Adapt. Co-authored-by: Ludovic Courtès <ludo@gnu.org> Mathieu Lirzin
2017-03-20build: Install .go files to $libdir/guile/X.Y....* configure.ac: Define and substitute 'guileobjectdir'. * Makefile.am (nobase_nodist_guilemodule_DATA): Remove $(GOBJECTS). (nobase_nodist_guileobject_DATA): New variable. (guix_install_go_files): Adjust accordingly. (install-data-hook): Likewise. * scripts/guix.in (config-lookup): Add 'exec_prefix' and 'guileobjectdir'. Add '_' in VAR-REF-REGEXP. (maybe-augment-load-paths!): Distinguish OBJECT-DIR from MODULE-DIR. Ludovic Courtès
2016-04-06challenge: Really exit with non-zero upon hash mismatch....Reported by John Darrington. * guix/scripts/challenge.scm (guix-challenge): Add an explicit 'exit' call when ISSUES is empty. * scripts/guix.in: Add comment about 'exit'. * doc/guix.texi (Invoking guix challenge): Mention the behavior and exit code. Ludovic Courtès
2014-06-14guix: Look for "guix-packages" messages in $localedir....* scripts/guix.in (run-guix-main): Add 'bindtextdomain' call. Ludovic Courtès