32 lines
891 B
Diff
32 lines
891 B
Diff
|
Fix out-of-bounds read in c_substitute():
|
||
|
|
|
||
|
|
http://seclists.org/oss-sec/2016/q4/612
|
||
|
|
|
||
|
|
Patch copied from upstream source repository:
|
||
|
|
|
||
|
|
https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596
|
||
|
|
|
||
|
|
From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001
|
||
|
|
From: christos <christos>
|
||
|
|
Date: Fri, 2 Dec 2016 16:59:28 +0000
|
||
|
|
Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting
|
||
|
|
tcsh and hitting tab at the prompt)
|
||
|
|
|
||
|
|
---
|
||
|
|
ed.chared.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/ed.chared.c b/ed.chared.c
|
||
|
|
index 1277e53..310393e 100644
|
||
|
|
--- ed.chared.c
|
||
|
|
+++ ed.chared.c
|
||
|
|
@@ -750,7 +750,7 @@ c_substitute(void)
|
||
|
|
/*
|
||
|
|
* If we found a history character, go expand it.
|
||
|
|
*/
|
||
|
|
- if (HIST != '\0' && *p == HIST)
|
||
|
|
+ if (p >= InputBuf && HIST != '\0' && *p == HIST)
|
||
|
|
nr_exp = c_excl(p);
|
||
|
|
else
|
||
|
|
nr_exp = 0;
|