sharutils obscure fscanf() buffer overflow

[Ulf Härnhammar]

Hello,

I have found an obscure buffer overflow in shar from the sharutils 4.2.1
package.

The shar command executes wc when creating shar archives. In the rather
unlikely scenario where there is a malicious wc command installed that
prints lots of output, a buffer overflow will occur in shar, because of a
"%s" format string in an fscanf() call in shar.c.

This is of course no serious security threat. Nevertheless, I think it
is worth fixing, as the Right Thing for a program should be not to assume
anything about its input and to handle various problems well.

I have attached a patch against sharutils-4.2.1 and an evil wc command that
exhibits this problem in shar on my machine (Debian GNU/Linux testing).

// Ulf Harnhammar
   http://www.advogato.org/person/metaur/

wc
Description: Text document

sharutils.patch
Description: Text document