Skip to content

Fix short writes in scanner temp output paths #1697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
val-ms wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −10
Open

Fix short writes in scanner temp output paths #1697

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 13 additions & 10 deletions libclamav/scanners.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,7 +281,7 @@
cli_dbgmsg("RAR: ERROR: Failed to open output file\n");
} else {
cli_dbgmsg("RAR: Writing the archive comment to temp file: %s\n", comment_fullpath);
if (0 == write(comment_fd, comment, comment_size)) {
if (cli_writen(comment_fd, comment, comment_size) != comment_size) {
cli_dbgmsg("RAR: ERROR: Failed to write to output file\n");
}
close(comment_fd);
Expand Down Expand Up @@ -668,6 +668,8 @@
if (comments != NULL) {
uint32_t i;
for (i = 0; i < nComments; i++) {
size_t comment_len = strlen(comments[i]);

/*
* Drop the comment to a temp file, if requested
*/
Expand All @@ -691,7 +693,7 @@
cli_dbgmsg("EGG: ERROR: Failed to open output file\n");
} else {
cli_dbgmsg("EGG: Writing the archive comment to temp file: %s\n", comment_fullpath);
if (0 == write(comment_fd, comments[i], nComments)) {
if (cli_writen(comment_fd, comments[i], comment_len) != comment_len) {
cli_dbgmsg("EGG: ERROR: Failed to write to output file\n");
}
close(comment_fd);
Expand All @@ -703,7 +705,7 @@
/*
* Scan the comment.
*/
status = cli_magic_scan_buff(comments[i], strlen(comments[i]), ctx, NULL, LAYER_ATTRIBUTES_NONE);
status = cli_magic_scan_buff(comments[i], comment_len, ctx, NULL, LAYER_ATTRIBUTES_NONE);
if (status != CL_SUCCESS) {
goto done;
}
Expand Down Expand Up @@ -850,12 +852,11 @@
cli_dbgmsg("EGG: ERROR: Failed to open output file\n");
} else {
cli_dbgmsg("EGG: Writing the extracted file contents to temp file: %s\n", extract_fullpath);
if (0 == write(extracted_fd, extract_buffer, extract_buffer_len)) {
if (cli_writen(extracted_fd, extract_buffer, extract_buffer_len) != extract_buffer_len) {
cli_dbgmsg("EGG: ERROR: Failed to write to output file\n");
} else {
close(extracted_fd);
extracted_fd = -1;
}
close(extracted_fd);
extracted_fd = -1;
}
}

Expand Down Expand Up @@ -2723,7 +2724,7 @@
break;
map_off += written;

if (write(ofd, state.out, state.out_pos) == -1) {
if (cli_writen(ofd, state.out, state.out_pos) != state.out_pos) {
cli_errmsg("cli_scanscript: can't write to file %s\n", tmpname);
ret = CL_EWRITE;
goto done;
Expand Down Expand Up @@ -2771,7 +2772,7 @@
at += len;
if (!buff || !len || state.out_pos + len > state.out_len) {
/* flush if error/EOF, or too little buffer space left */
if ((ofd != -1) && (write(ofd, state.out, state.out_pos) == -1)) {
if ((ofd != -1) && (cli_writen(ofd, state.out, state.out_pos) != state.out_pos)) {
cli_errmsg("cli_scanscript: can't write to file %s\n", tmpname);
close(ofd);
ofd = -1;
Expand Down Expand Up @@ -2879,7 +2880,9 @@
at += bytes;
decoded = cli_utf16toascii(buff, bytes);
if (decoded) {
if (write(fd, decoded, bytes / 2) == -1) {
size_t decoded_len = bytes / 2;

if (cli_writen(fd, decoded, decoded_len) != decoded_len) {
cli_errmsg("cli_scanhtml_utf16: Can't write to file %s\n", tempname);
status = CL_EWRITE;
goto done;
Expand Down Expand Up @@ -3844,7 +3847,7 @@
// First check if actually a GPT, not MBR.
cl_error_t iret = cli_mbr_check2(ctx, 0);

if ((iret == CL_TYPE_GPT) && (DCONF_ARCH & ARCH_CONF_GPT)) {

Check warning on line 3850 in libclamav/scanners.c

View workflow job for this annotation

GitHub Actions / build-windows 

 operands are different enum types 'cl_error_t' and 'cli_file'; use an explicit cast to silence this warning
// Reassign type of current layer based on what we discovered
if (CL_SUCCESS != (ret = cli_recursion_stack_change_type(ctx, CL_TYPE_GPT, true))) {
cli_dbgmsg("Call to cli_recursion_stack_change_type() returned %s \n", cl_strerror(ret));
Expand Down Expand Up @@ -4145,7 +4148,7 @@
case CL_TYPE_HTML:
if (cli_recursion_stack_get_type(ctx, -2) == CL_TYPE_AUTOIT) {
/* bb#11196 - autoit script file misclassified as HTML */
ret = CL_TYPE_TEXT_ASCII;

Check warning on line 4151 in libclamav/scanners.c

View workflow job for this annotation

GitHub Actions / build-windows 

 implicit conversion from enum type 'cli_file' to enum type 'cl_error_t'; use an explicit cast to silence this warning
} else if (SCAN_PARSE_HTML &&
(type == CL_TYPE_TEXT_ASCII ||
type == CL_TYPE_GIF) && /* Scan GIFs for embedded HTML/Javascript */
Expand Down
Loading