Re: Possible Memcpy and write out of bounds error in Wordsplit.

2023-11-01 Thread Paul Eggert
Thanks, I think that bug was fixed here: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=5114218025b4562392dd260e2533d3fa2bc0220e

Possible Memcpy and write out of bounds error in Wordsplit.

2023-11-01 Thread Kenneth Salt
tar.1.35 has a heap buffer overflow vulnerability when splitting words through the wordsplit library. reproduction case: ./tar1.35 --group-map=<(python3 -c 'print("\x27\x27\x3f\x3f"+"A"*4035)') The changes in coalesce_segment from 1.34 to 1.35 do a memcpy into a length one buffer without checking