From ed192f410da36aedf5e54bb3f967e6613ab4bb51 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Thu, 3 Dec 2020 10:44:27 +0100 Subject: Don't parse \x and \0 past the end in DeEscapeString MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This has no attack surface though as the loop is to end very soon anyhow and the method only used while reading CD-ROM mountpoints which seems like a very unlikely attack vector… --- test/libapt/strutil_test.cc | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'test') diff --git a/test/libapt/strutil_test.cc b/test/libapt/strutil_test.cc index f101d72cf..d477e953c 100644 --- a/test/libapt/strutil_test.cc +++ b/test/libapt/strutil_test.cc @@ -21,6 +21,12 @@ TEST(StrUtilTest,DeEscapeString) // double slashes EXPECT_EQ("foo\\ x", DeEscapeString("foo\\\\ x")); EXPECT_EQ("\\foo\\", DeEscapeString("\\\\foo\\\\")); + + // FIXME: the input is bad, the output as well, but we have no indicator for it + EXPECT_EQ("aa", DeEscapeString("aa\\x")); + EXPECT_EQ("aa0", DeEscapeString("aa\\x0")); + EXPECT_EQ("aa", DeEscapeString("aa\\0")); + EXPECT_EQ("aaa", DeEscapeString("aa\\0a")); } TEST(StrUtilTest,StringStrip) { -- cgit v1.2.3-18-g5258