GNU bug report logs - #59544
[PATCH] Fixed lib-src/etags.c command execute vulnerability

Previous Next

Full log

View this message in rfc822 format

From: Eli Zaretskii <eliz <at> gnu.org>
To: lux <lx <at> shellcodes.org>
Cc: 59544 <at> debbugs.gnu.org, stefankangas <at> gmail.com
Subject: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability
Date: Sat, 26 Nov 2022 15:21:49 +0200

> Date: Sat, 26 Nov 2022 11:09:26 +0800
> Cc: 59544 <59544 <at> debbugs.gnu.org>
> From: lux <lx <at> shellcodes.org>
> 
> +          linebuffer line;
> +          linebuffer_init (&line);
> +          while (readline_internal (&line, tag_f, tagfile) > 0)

This needs a minor adjustment: readline_internal removes the CR characters
from CR-LF end-of-lines, so I think using it unaltered will convert files
with DOS-style EOLs to Unix-style EOLs, because we write them with a single
newline at the end.  I think the best fix is to add one more argument to
readline_internal, which, if non-zero, will cause it to avoid removing the
CR characters.

> +ctags_update: CTAGS.good_update ${infiles}
> +	echo > CTAGS

This "echo" command creates an empty CTAGS file.  It would be better to have
at least a few lines there, so we could make sure the new code actually
removes some lines from its input.

Thanks.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.