Fix GString API migration regressions: lack of NUL after strncpy and use after free#5042
Conversation
8480e3e to
b0d6c82
Compare
|
Fixes 260126a. |
|
/rebase |
b0d6c82 to
5f0017d
Compare
|
I wish we had a test for this function, especially when a bug is getting fixed. @peripherium, would you be up for the task? I have added a test under similar circumstances; you can check this as an example: 7488fc5 . |
|
I build mc from last commit 9f0be66 and now can't open any tgz archive (after open one). Always get an error: |
5f0017d to
8c0ae94
Compare
|
Hi, while adding the requested unit test for The function was declared static, so I exposed it to the tests using To make the test build cleanly with and without This works for the test, but I wanted to ask if this is the preferred approach in MC, or if there is an established pattern for handling static globals used by testable functions. If there is a better way to structure this, I’d be happy to adjust the patch. Thanks. |
|
@zyv let's merge this PR. Currently, in master, we have broken entering to archives. |
Sorry, I'll try to have a look today. |
|
/rebase |
ce2ad8b to
89629c2
Compare
Signed-off-by: Manuel Einfalt <einfalt1@proton.me> Signed-off-by: Yury V. Zaytsev <yury@shurup.com>
extfs_skip_leading_dotslash() returns a const pointer to the substring of an argument, therefore an argument must not be free'd immediately after call of extfs_skip_leading_dotslash(). Fixes 260126a. Signed-off-by: Andrew Borodin <aborodin@vmail.ru> Signed-off-by: Yury V. Zaytsev <yury@shurup.com>
…ate symbols Signed-off-by: Yury V. Zaytsev <yury@shurup.com>
89629c2 to
31ab988
Compare
zyv
left a comment
There was a problem hiding this comment.
Okay, guys, I'm sorry that it has taken me so long.
I have fixed the build on macOS due to duplicate symbols. Otherwise, I find the code good. And I appreciate the test very much. Thank you @peripherium for an excellent contribution!
I will not be adding this to the NEWS, since it's a regression in master after an internal migration.

strncpy() was called with text->len, which does not include the terminating NUL byte. As a result, when a shorter filename was copied after a longer one, the global buffer retained trailing characters from the previous value, producing an invalid path.
The fix copies text->len + 1 bytes to include the guaranteed NUL terminator provided by GString.