[Bug 225761] net/rsync long path causes buffer overflow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225761

            Bug ID: 225761
           Summary: net/rsync long path causes buffer overflow
           Product: Ports & Packages
           Version: Latest
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: Individual Port(s)
          Assignee: ehaupt at FreeBSD.org
          Reporter: os at ist.ac.at
             Flags: maintainer-feedback?(ehaupt at FreeBSD.org)
          Assignee: ehaupt at FreeBSD.org

Hello,

running rsync will cause a buffer overflow when the following conditions are
met:
* rsync syncs over the network (two hosts)
* path too long


expected behavior (output from local sync):

root at f:~ # rsync -aHAX /srv/test /tmp/asd/
filename overflows max-path len by 3:
test/ttest.data/test.asd/ttest.data......ttest.data/test.asd/ttest.data/asd.dddddd
rsync error: some files/attrs were not transferred (see previous errors) (code
23) at main.c(1200) [sender=3.1.2]

actual behavior:

root at f:~ # rsync -aHAX testsmba:/srv/test /tmp/
overflow: xflags=0x20fe l1=255 l2=769
lastname=test/ttest.data/............./ttest.data/test.asd/ttest.data
[receiver]
ERROR: buffer overflow in recv_file_entry [receiver]
rsync error: error allocating core memory buffers (code 22) at util2.c(112)
[receiver=3.1.2]
rsync: [generator] write error: Broken pipe (32)
rsync: [receiver] write error: Broken pipe (32)


versions used:
FreeBSD 11.1: rsync  version 3.1.2  protocol version 31
Debian Stretch: rsync  version 3.1.2  protocol version 31

In the example above the /srv/test directory contains only directories was
created by the following command:

mkdir -p
/srv/test/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/ttest.data/test.asd/

-- 
You are receiving this mail because:
You are the assignee for the bug.