From 2d3efa555ae8ce92d05d503bd65a05a3d4a5a64d Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Apr 18 2018 13:09:17 +0000
Subject: Resolves: CVE-2018-1083 - fix stack-based buffer overflow in gen_matches_files()


---

diff --git a/0007-zsh-5.4.2-CVE-2018-1083.patch b/0007-zsh-5.4.2-CVE-2018-1083.patch
new file mode 100644
index 0000000..322d093
--- /dev/null
+++ b/0007-zsh-5.4.2-CVE-2018-1083.patch
@@ -0,0 +1,46 @@
+From ca7c69f009bf0e13b2c7cbb02310f7c322ee12a0 Mon Sep 17 00:00:00 2001
+From: Oliver Kiddle <okiddle@yahoo.co.uk>
+Date: Sat, 24 Mar 2018 15:04:39 +0100
+Subject: [PATCH] 42519, CVE-2018-1083: check bounds on PATH_MAX-sized
+ buffer used for file completion candidates
+
+Upstream-commit: 259ac472eac291c8c103c7a0d8a4eaf3c2942ed7
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ Src/Zle/compctl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/Src/Zle/compctl.c b/Src/Zle/compctl.c
+index 5414b8f..29649ac 100644
+--- a/Src/Zle/compctl.c
++++ b/Src/Zle/compctl.c
+@@ -2176,6 +2176,8 @@ gen_matches_files(int dirs, int execs, int all)
+     if (prpre && *prpre) {
+ 	pathpref = dupstring(prpre);
+ 	unmetafy(pathpref, &pathpreflen);
++	if (pathpreflen > PATH_MAX)
++	    return;
+ 	/* system needs NULL termination, not provided by unmetafy */
+ 	pathpref[pathpreflen] = '\0';
+     } else {
+@@ -2218,6 +2220,8 @@ gen_matches_files(int dirs, int execs, int all)
+ 		     * the path buffer by appending the filename.       */
+ 		    ums = dupstring(n);
+ 		    unmetafy(ums, &umlen);
++		    if (umlen + pathpreflen + 1 > PATH_MAX)
++			continue;
+ 		    memcpy(q, ums, umlen);
+ 		    q[umlen] = '\0';
+ 		    /* And do the stat. */
+@@ -2232,6 +2236,8 @@ gen_matches_files(int dirs, int execs, int all)
+ 			/* We have to test for a path suffix. */
+ 			int o = strlen(p), tt;
+ 
++			if (o + strlen(psuf) > PATH_MAX)
++			    continue;
+ 			/* Append it to the path buffer. */
+ 			strcpy(p + o, psuf);
+ 
+-- 
+2.14.3
+
diff --git a/zsh.spec b/zsh.spec
index 0833cbb..ea6645d 100644
--- a/zsh.spec
+++ b/zsh.spec
@@ -21,6 +21,9 @@ Patch5:  0005-zsh-5.4.2-CVE-2018-7549.patch
 # fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
 Patch6:  0006-zsh-5.4.2-CVE-2018-1071.patch
 
+# fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
+Patch7:  0007-zsh-5.4.2-CVE-2018-1083.patch
+
 BuildRequires: coreutils
 BuildRequires: gawk
 BuildRequires: gdbm-devel
@@ -178,6 +181,7 @@ fi
 
 %changelog
 * Wed Apr 18 2018 Kamil Dudka <kdudka@redhat.com> - 5.4.1-3
+- fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
 - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
 
 * Tue Mar 06 2018 Kamil Dudka <kdudka@redhat.com> - 5.4.1-2