Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111022011903.GA31685@openwall.com>
Date: Sat, 22 Oct 2011 05:19:03 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: hardlink(1) has buffer overflows, is unsafe on changing trees

On Sat, Oct 22, 2011 at 04:56:21AM +0400, Solar Designer wrote:
>       strcpy (p, di->d_name);
> 
> where "p" points somewhere inside nambuf1.
> 
> These will just need different reproducers.

Actually, I think my proposed reproducer (many nested 250-char dirs)
triggers this one and not the strcat().  On one build, hardlink then
crashes after dereferencing the "dirs" pointer, which happens to be
overwritten with a directory name.  On another build (different gcc
version and arch), hardlink does not crash (although I think it would on
even more nested directories), but reports a ridiculous directory count
(so "ndirs" is overwritten).  -D_FORTIFY_SOURCE=2 didn't make a
difference here (different program binary, same observed behavior).

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.