pkgs/rsync/patches/rsync-3.0.7-buf-overflow.patch

   1 index 7139b10..fef15aa 100644
   2 --- a/flist.c
   3 +++ b/flist.c
   4 @@ -1640,21 +1640,29 @@ static void send_directory(int f, struct file_list *flist, char *fbuf, int len,
   5         }
   6
   7         p = fbuf + len;
   8 -       if (len != 1 || *fbuf != '/')
   9 +       if (len == 1 && *fbuf == '/')
  10 +               remainder = MAXPATHLEN - 1;
  11 +       else if (len < MAXPATHLEN-1) {
  12                 *p++ = '/';
  13 -       *p = '\0';
  14 -       remainder = MAXPATHLEN - (p - fbuf);
  15 +               *p = '\0';
  16 +               remainder = MAXPATHLEN - (len + 1);
  17 +       } else
  18 +               remainder = 0;
  19
  20         for (errno = 0, di = readdir(d); di; errno = 0, di = readdir(d)) {
  21                 char *dname = d_name(di);
  22                 if (dname[0] == '.' && (dname[1] == '\0'
  23                     || (dname[1] == '.' && dname[2] == '\0')))
  24                         continue;
  25 -               if (strlcpy(p, dname, remainder) >= remainder) {
  26 +               unsigned name_len = strlcpy(p, dname, remainder);
  27 +               if (name_len >= remainder) {
  28 +                       char save = fbuf[len];
  29 +                       fbuf[len] = '\0';
  30                         io_error |= IOERR_GENERAL;
  31                         rprintf(FERROR_XFER,
  32 -                               "cannot send long-named file %s\n",
  33 -                               full_fname(fbuf));
  34 +                               "filename overflows max-path len by %u: %s/%s\n",
  35 +                               name_len - remainder + 1, fbuf, dname);
  36 +                       fbuf[len] = save;
  37                         continue;
  38                 }
  39                 if (dname[0] == '\0') {