1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
From: Christian Kastner <ckk@kvr.at>
Date: Sat, 26 Dec 2015 19:03:24 +0100
Subject: Don't silently truncate commands
Commands have a maximum length. When hitting this maximum, generate an error
instead of silently truncated the command.
Bug-Debian: https://bugs.debian.org/686223
Forwarded: no
Last-Update: 2015-12-26
---
crontab.5 | 3 ++-
entry.c | 14 ++++++++++++--
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/crontab.5 b/crontab.5
index ad2c6d2..9db8166 100644
--- a/crontab.5
+++ b/crontab.5
@@ -112,7 +112,8 @@ followed by a command, followed by a newline character ('\en').
The system crontab (/etc/crontab) uses the same format, except that
the username for the command is specified after the time and
date fields and before the command. The fields may be separated
-by spaces or tabs.
+by spaces or tabs. The maximum permitted length for the command field is
+998 characters.
.PP
Commands are executed by
.IR cron (8)
diff --git a/entry.c b/entry.c
index 567562f..0cfa8c0 100644
--- a/entry.c
+++ b/entry.c
@@ -31,7 +31,7 @@ static char rcsid[] = "$Id: entry.c,v 2.12 1994/01/17 03:20:37 vixie Exp $";
typedef enum ecode {
e_none, e_minute, e_hour, e_dom, e_month, e_dow,
- e_cmd, e_timespec, e_username
+ e_cmd, e_timespec, e_username, e_cmd_len
} ecode_e;
static char get_list __P((bitstr_t *, int, int, char *[], int, FILE *)),
@@ -50,6 +50,7 @@ static char *ecodes[] =
"bad command",
"bad time specifier",
"bad username",
+ "command too long",
};
@@ -311,9 +312,18 @@ load_entry(file, error_func, pw, envp)
/* Everything up to the next \n or EOF is part of the command...
* too bad we don't know in advance how long it will be, since we
* need to malloc a string for it... so, we limit it to MAX_COMMAND.
+ *
+ * To err on the side of caution, if the command string length is
+ * equal to MAX_COMMAND, we will assume that the command has been
+ * truncated and generate an error.
+ *
* XXX - should use realloc().
- */
+ */
ch = get_string(cmd, MAX_COMMAND, file, "\n");
+ if (strnlen(cmd, MAX_COMMAND) == MAX_COMMAND - 1) {
+ ecode = e_cmd_len;
+ goto eof;
+ }
/* a file without a \n before the EOF is rude, so we'll complain...
|
