From 35f58d8a3e090ea02068effdfed41ec12d1d917e Mon Sep 17 00:00:00 2001 From: Qualys Security Advisory Date: Thu, 1 Jan 1970 00:00:00 +0000 Subject: [PATCH] pgrep: Initialize the cmd*[] stack buffers. Otherwise (for example), if the (undocumented) opt_echo is set, but not opt_long, and not opt_longlong, and not opt_pattern, there is a call to xstrdup(cmdoutput) but cmdoutput was never initialized: sleep 60 & echo "$!" > pidfile env -i LD_DEBUG=`perl -e 'print "A" x 131000'` pkill -e -c -F pidfile | xxd ... 000001c0: 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA 000001d0: 4141 4141 4141 4141 fcd4 e6bd e47f 206b AAAAAAAA...... k 000001e0: 696c 6c65 6420 2870 6964 2031 3230 3931 illed (pid 12091 000001f0: 290a 310a ).1. [1]+ Terminated sleep 60 (the LD_DEBUG is just a trick to fill the initial stack with non-null bytes, to show that there is uninitialized data from the stack in the output; here, an address "fcd4 e6bd e47f") --- pgrep.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pgrep.c b/pgrep.c index e37678b2..4199ac44 100644 --- a/pgrep.c +++ b/pgrep.c @@ -497,9 +497,9 @@ static struct el * select_procs (int *num) regex_t *preg; pid_t myself = getpid(); struct el *list = NULL; - char cmdline[CMDSTRSIZE]; - char cmdsearch[CMDSTRSIZE]; - char cmdoutput[CMDSTRSIZE]; + char cmdline[CMDSTRSIZE] = ""; + char cmdsearch[CMDSTRSIZE] = ""; + char cmdoutput[CMDSTRSIZE] = ""; proc_t ns_task; ptp = do_openproc();