oss-security - Re: xterm terminal crash due to malicious character sequences in file name

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a53zyugg.fsf@gmail.com>
Date: Sat, 16 Aug 2025 11:47:43 -0700
From: Collin Funk <collin.funk1@...il.com>
To: Erik Auerswald <auerswal@...x-ag.uni-kl.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: xterm terminal crash due to malicious character
 sequences in file name

Hi Erik,

Erik Auerswald <auerswal@...x-ag.uni-kl.de> said:

> On Wed, Aug 13, 2025 at 07:00:58PM +0200, Vincent Lefevre wrote:
> > The following makes the xterm terminal crash
> > 
> >   touch "$(printf "file\e[H\e[c\n\b")"
> >   gunzip file*
> > 
> > due to malicious character sequences in the file name and a bug in
> > xterm. Same issue with bunzip2 instead of gunzip.
> 
> I do not expect this to only happen with gunzip and bzip2.  Does this
> happen with any program that prints the filename without any escaping,
> e.g., "echo file*", and most programs that print the provided filename
> when reporting any associated problem (i.e., all that do not escape or
> suppress non-printable filename characters or bytes)?

Yep, any program will print non-printable characters unless it has some
logic to not do so.

Many GNU programs (from Coreutils and Findutils, for example) use the
'quote' module from Gnulib to print file names in a way that can be
copy-pasted in a shell shell command [1]. Here is an example using ls
from Coreutils:

    $ touch 'first
    file'
    $ touch 'second file'
    $ ls
    'first'$'\n''file'  'second file'

Generally this is an extra program feature. The real issue here was the
xterm crash.

I guess it would be nice for gzip to quote file names nicely. I'll have
a look at sending a patch. The only reason tjat it doesn't already do it
is probably because it is changed less frequently than other GNU
programs.

Collin

[1] https://www.gnu.org/software/gnulib/manual/gnulib.html#Quoting-1

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.