emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

skill: Prevent multiple overflows in ENLIST().

Browse Source 
First problem: saved_argc was used to calculate the size of the array,
but saved_argc was never initialized. This triggers an immediate heap-
based buffer overflow:

$ skill -c0 -c0 -c0 -c0
Segmentation fault (core dumped)

Second problem: saved_argc was not the upper bound anyway, because one
argument can ENLIST() several times (for example, in parse_namespaces())
and overflow the array as well.

Third problem: integer overflow of the size of the array.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent 56e696ca5f
commit 858df7cc89
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
skill.c
View File

@ -68,13 +68,13 @@ static int ns_pid;
static proc_t ns_task; static proc_t ns_task;
#define ENLIST(thing,addme) do{ \ #define ENLIST(thing,addme) do{ \
if(!thing##s) thing##s = xmalloc(sizeof(*thing##s)*saved_argc); \ if(thing##_count < 0 || (size_t)thing##_count >= INT_MAX / sizeof(*thing##s)) \
xerrx(EXIT_FAILURE, _("integer overflow")); \
thing##s = xrealloc(thing##s, sizeof(*thing##s)*(thing##_count+1)); \
thing##s[thing##_count++] = addme; \ thing##s[thing##_count++] = addme; \
}while(0) }while(0)
static int my_pid; static int my_pid;
static int saved_argc;
static int sig_or_pri; static int sig_or_pri;
enum { enum {