Commit Graph

1897 Commits

Author SHA1 Message Date
Qualys Security Advisory
56e696ca5f skill: Fix double-increment of pid_count.
No need to "pid_count++;" because "ENLIST(pid," does it already. Right
now this can trigger a heap-based buffer overflow.

Also, remove the unneeded "pid_count = 0;" (it is static, and
skillsnice_parse() is called only once; and the other *_count variables
are not initialized explicitly either).
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
b019fdba5c skill: Remove unused NEXTARG macro. 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
0e1964bfbc skill: Always NULL-terminate argv.
The memmove() itself does not move the NULL-terminator, because nargs is
decremented first. Copy how skill_sig_option() does it: decrement nargs
last, and remove the "if (nargs - i)" (we are in "while (i < nargs)").
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
453e1df5d1 skill: Fix getline() usage.
man getline: "If *lineptr is set to NULL and *n is set 0 before the
call, then getline() will allocate a buffer for storing the line. This
buffer should be freed by the user program even if getline() failed."
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
7d6977b6f7 skill: Simplify the kill_main() loop.
Right now the "loop=0; break;" is never reached.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
daec51a06c pwdx: Fix a misleading comment.
It sounds like an off-by-one, but the code itself is correct.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
6df9ffb341 pidof: Prevent integer overflows with grow_size().
Note: unlike "size" and "omit_size", "path_alloc_size" is not multiplied
by "sizeof(struct el)" but the checks in grow_size() allow for a roughly
100MB path_alloc_size, which should be more than enough for readlink().
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
ab8b3881a0 pidof: Do not memleak pidof_root if multiple -c options. 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
bba9f384c0 pidof: Do not skip the NULL terminator in cmdline.
This should never happen (cmdline[0] should always be non-NULL), but
just in case.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
6cadda2b4f pidof: Get the arg1 base name with get_basename().
Same as program_base, cmd_arg0base, and exe_link_base.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
6f2f033142 pidof: Do not memleak the contents of proc_t.
Just like "pgrep: Do not memleak the contents of proc_t."
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
031bc56f65 tload: Prevent integer overflows of ncols, nrows, and scr_size.
Also, use xerrx() instead of xerr() since errno is not set.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
4c346cf594 tload: Prevent a buffer overflow when row equals nrows.
When max_scale is very small, scale_fact is very small, row is equal to
nrows, p points outside screen, and the write to *p is out-of-bounds.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
d5442e10a7 tload: Use snprintf() instead of sprintf(). 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
afbb0f4886 tload: Call longjmp() 1 instead of 0.
Do it explicitly instead of the implicit "longjmp() cannot cause 0 to be
returned. If longjmp() is invoked with a second argument of 0, 1 will be
returned instead."
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
7664d9f306 tload: Use standard names instead of numbers. 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
5f3c071cd3 slabtop: Reset slab_list if get_slabinfo() fails.
Otherwise "the state of 'list' and 'stats' are undefined" (as per
get_slabinfo()'s documentation) and free_slabinfo() crashes (a
use-after-free).
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
2fc42db322 uptime: Check the return value of various functions. 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
b51ca2a1f8 pgrep: Prevent a potential stack-based buffer overflow.
This is one of the worst issues that we found: if the strlen() of one of
the cmdline arguments is greater than INT_MAX (it is possible), then the
"int bytes" could wrap around completely, back to a very large positive
int, and the next strncat() would be called with a huge number of
destination bytes (a stack-based buffer overflow).

Fortunately, every distribution that we checked compiles its procps
utilities with FORTIFY, and the fortified strncat() detects and aborts
the buffer overflow before it occurs.

This patch also fixes a secondary issue: the old "--bytes;" meant that
cmdline[sizeof (cmdline) - 2] was never written to if the while loop was
never entered; in the example below, "ff" is the uninitialized byte:

((exec -ca `python3 -c 'print("A" * 131000)'` /usr/bin/cat < /dev/zero) | sleep 60) &
pgrep -a -P "$!" 2>/dev/null | hexdump -C
00000000  31 32 34 36 30 20 41 41  41 41 41 41 41 41 41 41  |12460 AAAAAAAAAA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
*
00001000  41 41 41 41 ff 0a 31 32  34 36 32 20 73 6c 65 65  |AAAA..12462 slee|
00001010  70 20 36 30 0a                                    |p 60.|
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
40c4254318 pgrep: Always null-terminate the cmd*[] buffers.
Otherwise, man strncpy: "If there is no null byte among the first n
bytes of src, the string placed in dest will not be null-terminated."
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
35f58d8a3e pgrep: Initialize the cmd*[] stack buffers.
Otherwise (for example), if the (undocumented) opt_echo is set, but not
opt_long, and not opt_longlong, and not opt_pattern, there is a call to
xstrdup(cmdoutput) but cmdoutput was never initialized:

sleep 60 & echo "$!" > pidfile
env -i LD_DEBUG=`perl -e 'print "A" x 131000'` pkill -e -c -F pidfile | xxd
...
000001c0: 4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA
000001d0: 4141 4141 4141 4141 fcd4 e6bd e47f 206b  AAAAAAAA...... k
000001e0: 696c 6c65 6420 2870 6964 2031 3230 3931  illed (pid 12091
000001f0: 290a 310a                                ).1.
[1]+  Terminated              sleep 60

(the LD_DEBUG is just a trick to fill the initial stack with non-null
bytes, to show that there is uninitialized data from the stack in the
output; here, an address "fcd4 e6bd e47f")
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
d0d902f089 pgrep: Simplify the match_*() functions. 2018-05-19 07:32:21 +10:00
Qualys Security Advisory
5d2b44eaf6 pgrep: Replace buf+1 with buf in read_pidfile().
Unless we missed something, this makes it unnecessarily difficult to
read/audit.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
c1dbd41d2b pgrep: Replace ints with longs in strict_atol().
atol() means long, and value points to a long.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
4ea5b22d62 pgrep: Prevent integer overflow of list size.
Not exploitable (not under an attacker's control), but still a potential
non-security problem. Copied, fixed, and used the grow_size() macro from
pidof.c.
2018-05-19 07:32:21 +10:00
Qualys Security Advisory
657053f5d0 pgrep: Do not memleak the contents of proc_t.
memset()ing task and subtask inside their loops prevents free_acquired()
(in readproc() and readtask()) from free()ing their contents (especially
cmdline and environ).

Our solution is not perfect, because we still memleak the very last
cmdline/environ, but select_procs() is called only once, so this is not
as bad as it sounds.

It would be better to leave subtask in its block and call
free_acquired() after the loop, but this function is static (not
exported).

The only other solution is to use freeproc(), but this means replacing
the stack task/subtask with xcalloc()s, thus changing a lot of code in
pgrep.c (to pointer accesses).

Hence this imperfect solution for now.
2018-05-19 07:32:21 +10:00
Craig Small
75bd099420 library: check not undef SIGLOST
sig.c had this odd logic where on non-Hurd systems it would undefine
SIGLOST. Fine for Hurd or amd64 Linux systems. Bad for a sparc which
has SIGLOST defined *and* is not Hurd.

Just check its defined, its much simpler.
2018-05-03 21:06:05 +10:00
Craig Small
ca07bcad4d misc: fix ps etime tests
The test assumes only one process appears which, depending on the
speed of things, may not be true. It now matches one to many process
lines.
2018-04-10 22:09:40 +10:00
Craig Small
3afea8abab update translations 2018-04-10 21:37:39 +10:00
Craig Small
5576c8e438 library: build on non-glibc systems
Some non-glibc systems didn't have libio.h or __BEGIN_DECLS
Changes to make it more standard.

References:
 issue #88
2018-04-10 21:28:11 +10:00
Craig Small
58bff862fc free: fix scaling on 32-bit systems
Systems that have a 32-bit long would give incorrect results in free.

References:
 Issue #89
 https://www.freelists.org/post/procps/frees-scale-size-broken-with-32bit-long
2018-04-10 21:20:25 +10:00
Craig Small
1982a79ba8 misc: Update news about #91 2018-04-10 21:16:10 +10:00
Craig Small
791cb72d32 Revert "Support running with child namespaces"
This reverts commit dcb6914f11.

This commit broke a lot of scripts that were expecting to see all
programs. See #91
2018-04-10 21:14:01 +10:00
Craig Small
0b488c7f5c pgrep: Don't segfault with no match
If pgrep is run with a non-program name match and there are
no matches, it segfaults.

The testsuite thinks zero bytes sent, and zero bytes sent
because the program crashed is the same :/

References:
 commit 1aacf4af7f
 https://bugs.debian.org/894917

Signed-off-by: Craig Small <csmall@enc.com.au>
2018-04-06 23:00:29 +10:00
Craig Small
2fc2427ed3 misc: Update translations from Translation project 2018-04-01 17:37:10 +10:00
Craig Small
e22a5087dd 3.3.13 release candidate 1
Update NEWS with the version
Add library API change into NEWS
Update c:r:a for library to 7:0:1

This means the current and age are incremented, so old programs can
use new library but not vice-versa as they won't have the numa*
functions.
2018-03-12 16:30:58 +11:00
Craig Small
a1b7338b4a misc: Update translations
po4a is awful, basically.
2018-03-12 14:24:49 +11:00
Craig Small
f46865eaf3 sysctl: fixup build system
Remove the external definition of the procio function.
2018-03-12 13:06:08 +11:00
Craig Small
8954e4349c misc: update NEWS with some missed items 2018-03-03 18:59:17 +11:00
Craig Small
8517c86560 misc: Add link protection examples to sysctl.conf
Adds both examples to the sample sysctl.conf configuration file
to enable link protection for both hard and soft links.

Most kernels probably have this enabled anyhow.

References:
 https://bugs.debian.org/889098
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18078
 561ec64ae6
2018-03-03 18:56:20 +11:00
Craig Small
69f4b6ec8e docs: Note limitation of finding scripts in pidof.1
pidof will miss scripts that are run a certain way due to how
they appear in procfs. This is just a note to say it might miss
them.

References:
 procps-ng/procps#17
2018-03-03 18:47:22 +11:00
Craig Small
d4a9a1e5d4 watch: use sysconf() for hostname length
Hurd doesn't have HOST_NAME_MAX, neither does Solaris.
An early fix just checked for this value and used 64 instead.
This change uses sysconf which is the correct method, possibly until
this compiles on some mis-behaving OS which doesn't have this value.

References:
 commit e564ddcb01
 procps-ng/procps#54
2018-03-03 18:36:44 +11:00
Craig Small
1a26eec12b sysctl: fix typo in help
Changed "a variables" to "the given variable(s)"

References:
 procps-ng/procps#84
2018-03-03 18:29:19 +11:00
Craig Small
7c7781a120 docs: Reword --exec option in watch.1
The manual page for watch for the exec option was confusing and
backwards. Hopefully this one makes more sense.

References:
 procps-ng/procps#75
2018-03-03 18:26:47 +11:00
Craig Small
3fc3a20523 Merge branch 'dbanerje/procps-namespace'
References:
 procps-ng/procps!41
2018-03-03 18:00:56 +11:00
Debabrata Banerjee
dcb6914f11 Support running with child namespaces
By default pgrep/pkill should not kill processes in a namespace it is not
part of. If this is allowed, it allows callers to break namespaces they did
not expect to affect, requiring rewrite of all callers to fix.

So by default, we should work in the current namespace. If --ns 0 is
specified, they we look at all namespaces, and if any other pid is specified
we continue to look in only that namespace.

Signed-off-by: Debabrata Banerjee <dbanerje@akamai.com>
2018-03-03 17:59:18 +11:00
Jim Warner
029a463172 top: show that truncation indicator ('+') consistently
With a little luck, this should be the final tweak for
our support of extra wide characters. Currently, those
characters don't always display the '+' indicator when
they've been truncated. Now, it should always be seen.

[ plus it's done a tad more efficiently via snprintf ]

Signed-off-by: Jim Warner <james.warner@comcast.net>
2018-03-03 17:52:43 +11:00
Craig Small
5d0b094b8c ps: Add NEWS and checks for times and cputimes
The previous commit had one minor bug in it because the fields need
to be alphabetical and times comes after timeout.

Added NEWS item for this feature
Added another testsuite check for new flags in case they
disappear or go strange one day.

References:
 commit 8a94ed6111
2018-03-02 22:07:46 +11:00
Craig Small
942440d2a1 Merge branch 'sbigaret/procps-master'
References:
 procps-ng/procps!43
2018-03-02 21:59:47 +11:00
Sébastien Bigaret
8a94ed6111 ps: add times & cputimes format specifiers: cumulative CPU time in seconds
These format specifiers are to time & cputime what etimes is to etime.

Signed-off-by: Sébastien Bigaret <sebastien.bigaret@telecom-bretagne.eu>
2018-03-02 21:58:45 +11:00