autofs: Fix crash in sun_mount() From: Helge Deller In sun_mount() the variable np gets initialized to an alloca() memory area: np = noptions = alloca(); Later on, at the end of a loop, it may get accessed like this: *(np - 1) = '\0'; If np hasn't been increased in between those lines, this access triggers an out-of-bounds access which overwrites stack area and on the parisc architecture segfaults the automount executable as described in the Debian bugzilla #892953. The patch below adds the necessary check and thus fixes the crash. Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892953 Signed-off-by: Helge Deller Reviewed-by: Paul Menzel Signed-off-by: Ian Kent --- CHANGELOG | 1 + modules/parse_sun.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 10ad19e2..8e024420 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -18,6 +18,7 @@ xx/xx/2020 autofs-5.1.7 - fix ldap sasl reconnect problem. - samples/ldap.schema fix. - fix configure force shutdown check. +- fix crash in sun_mount(). 07/10/2019 autofs-5.1.6 - support strictexpire mount option. diff --git a/modules/parse_sun.c b/modules/parse_sun.c index 80fdf476..4b137f99 100644 --- a/modules/parse_sun.c +++ b/modules/parse_sun.c @@ -592,8 +592,9 @@ static int sun_mount(struct autofs_point *ap, const char *root, if (np > noptions + len) { warn(ap->logopt, MODPREFIX "options string truncated"); np[len] = '\0'; - } else + } else if (np > noptions) { *(np - 1) = '\0'; + } options = noptions; }