News for hackers. Stuff that matters.

A comment on Arbitrary file write vulnerability in GNU gzip's zgrep utility. Parent comment

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by nikonyrh on Monday April 18, 2022 @06:11PM (#31077288)
This reminds me that filenames can contain newlines.
[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by 10000truths on Tuesday April 19, 2022 @04:02AM (#31080655)
They can contain any octet except ASCII NUL and /.

That said, pretty much every filesystem's on-disk format has an explicit length field for file names. So in theory, there's nothing stopping them from supporting completely binary filenames - it's the kernel's VFS layer that treats NUL and / as special.

[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by tomrod on Monday April 18, 2022 @11:01PM (#31079381)
D:
[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by guipsp on Tuesday April 19, 2022 @01:52AM (#31080061)
And nulls :)
[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by hddqsb on Tuesday April 19, 2022 @02:01AM (#31080091)
How exactly can they contain nulls?

fopen() takes a null-terminated filename, so if there is a null byte in the middle it would just truncate the filename.

[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by minusf on Tuesday April 19, 2022 @02:32AM (#31080208)
that might be a corrupt filename that can be opened only by its inode in debugfs or similar.
[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by teddyh on Tuesday April 19, 2022 @02:43AM (#31080264)
No they can’t.
[ Parent | on HN ]