From bc5e3ab04c454c44b6c4d79b900c236cca35e9ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
Date: Thu, 22 Jun 2023 21:33:58 +0100
Subject: [PATCH] b2sum: fix UAR with --check with malformed checksum lines

* src/digest.c (split_3): Reinstate the check for whitespace after the
digest portion of the line, so that we exit early before inspecting
the file name which would be outside the passed buffer in the case
where the input does not contain a newline.
* tests/cksum/b2sum.sh: Add a test case.
* NEWS: Mention the bug fix.
Problem reported by Frank Busse using KLEE.
Fixes https://bugs.gnu.org/64229
---
 NEWS                 | 4 ++++
 src/digest.c         | 4 ++++
 tests/cksum/b2sum.sh | 5 +++++
 3 files changed, 13 insertions(+)

diff --git a/NEWS b/NEWS
index 3e2280777..3c134db52 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   fail on files with inode numbers that do not fit into 32 bits.
   [This bug was present in "the beginning".]
 
+  'b2sum --check' will no longer read unallocated memory when
+  presented with malformed checksum lines.
+  [bug introduced in coreutils-9.2]
+
   'cp --parents' again succeeds when preserving mode for absolute directories.
   Previously it would have failed with a "No such file or directory" error.
   [bug introduced in coreutils-9.1]
diff --git a/src/digest.c b/src/digest.c
index ab32968db..851c7d118 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -862,6 +862,10 @@ split_3 (char *s, size_t s_len,
   while (s[i] && !ISWHITE (s[i]))
     i++;
 
+  /* The digest must be followed by at least one whitespace character.  */
+  if (i == s_len)
+    return false;
+
   *d_len = &s[i] - (char *) *digest;
   s[i++] = '\0';
 
diff --git a/tests/cksum/b2sum.sh b/tests/cksum/b2sum.sh
index 6a2d13024..7013b4972 100755
--- a/tests/cksum/b2sum.sh
+++ b/tests/cksum/b2sum.sh
@@ -61,6 +61,11 @@ printf '%s\n' 'BLAKE2' 'BLAKE2b' 'BLAKE2-' 'BLAKE2(' 'BLAKE2 (' > crash.check \
   || framework_failure_
 returns_ 1 $prog -c crash.check || fail=1
 
+# This would read unallocated memory from coreutils-9.2 to coreutils-9.3
+# which would trigger with ASAN or valgrind
+printf '0A0BA0' > overflow.check || framework_failure_
+returns_ 1 $prog -c overflow.check || fail=1
+
 done
 
 Exit $fail
-- 
2.40.1