Debian Patches

Status for lrzsz/0.13.1-1

Patch Description Author Forwarded Bugs Origin Last update
02-rz-terminate-received-strings.diff rz: terminate received name blocks before C-string parsing zrdata() left the receive buffer unterminated, and procheader() then read
the name with strlen() and parsed trailing attributes at
name + 1 + strlen(name). A maximum-length ZFILE name without a NUL byte
caused an out-of-bounds read. The YMODEM file name block from wcrxpn() had
the same problem. Terminate the buffer after the payload in both places.
.
A name that fills the whole payload has no NUL of its own; zrdata() then
writes its terminator into secbuf[LRZSZ_MAX_SUBPACKET_LEN], and
nameend = name + 1 + strlen(name) reaches secbuf[1+LRZSZ_MAX_SUBPACKET_LEN],
one past the allocation, with or without --junk-path, so the *nameend
attribute read runs off the buffer. Allocate one extra byte and
clear the buffer once after allocation: no data byte is ever stored in the
last two bytes, so nameend and every string read in secbuf end inside it.
.
0.13.0 fixed the overflow of the Pathname copy (CVE-2026-105842) upstream;
this patch keeps the remaining part. The separate PATH_MAX length check that
earlier revisions of this patch added is dropped: after the buffer is
enlarged it is no longer needed for memory safety, and it reintroduced
PATH_MAX, which upstream deliberately removed in 0.13 (unbounded on GNU/Hurd).		 no
03-rz-junk-path-double-free.diff rz: clear file name aliases on the procheader() error paths procheader() freed name_static without clearing it or zi->fname, which still
aliased the freed block. With --junk-path a name ending in '/' returns ERROR,
and the caller's error logging then dereferenced the dangling zi->fname
(use-after-free); a following transfer freed name_static again (double free).
Set both name_static and zi->fname to NULL after freeing.		 no
lsz_manpage_default_typo.diff Fix typo in lsz.1. no

All known versions for source package 'lrzsz'

Links