[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251017235023.GA23530@openwall.com>
Date: Sat, 18 Oct 2025 01:50:23 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Thorsten Alteholz <debian@...eholz.de>
Subject: Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...)
On Sat, Oct 18, 2025 at 01:16:36AM +0200, Vincent Lefevre wrote:
> Debian distributes Mark R. Boyns's rplay 3.3.2. I've had
> a very quick look at the source and found at least:
>
> * In rplay/rplay.c line 600, the use of atoi() on something that
> looks like unsanitized data from a remote server:
>
> remote_size = -1;
> p = rptp_parse(response, "size");
> if (p)
> remote_size = atoi(p);
>
> * Various malloc() without a check of failure, such as:
These look like minor correctness and robustness issues.
In the code lines you quoted below, I am more worried about potential
for attacker triggerable integer overflows in calculation of malloc()
and realloc() sizes. These have the potential of being vulnerabilities
worse than DoS, so may be worth further investigation.
> contrib/xjukebox-0.9/xjukebox.c- *list = (spool_info **)realloc(*list, (*items_count + 1) *
> contrib/xjukebox-0.9/xjukebox.c- *nlist = (String *)realloc(*nlist, (*items_count + 1) * sizeof(String));
> rx/rxanal.c: *subexps = (struct rexp_node **)malloc (sizeof (struct rexp_node *) * *re_nsub);
> rx/rxanal.c- else
> rx/rxanal.c- *subexps = (struct rexp_node **)realloc (*subexps,
> rx/rxanal.c- sizeof (struct rexp_node *) * *re_nsub);
> My bug report in the Debian BTS:
>
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118224
>
> The upstream version was released in 1999, thus 26 years ago!
> And the rplay homepage no longer exists.
>
> Has anyone looked at this more closely?
> Are there CVEs?
I don't know. I did a quick search now, and couldn't find any.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
