[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251017235949.GD2696@qaa.vinc17.org>
Date: Sat, 18 Oct 2025 01:59:49 +0200
From: Vincent Lefevre <vincent@...c17.net>
To: oss-security@...ts.openwall.com
Subject: Re: rplay (Mark R. Boyns) potential security issues
(unsanitized data, unchecked malloc...)
On 2025-10-18 01:50:23 +0200, Solar Designer wrote:
> On Sat, Oct 18, 2025 at 01:16:36AM +0200, Vincent Lefevre wrote:
> > Debian distributes Mark R. Boyns's rplay 3.3.2. I've had
> > a very quick look at the source and found at least:
> >
> > * In rplay/rplay.c line 600, the use of atoi() on something that
> > looks like unsanitized data from a remote server:
> >
> > remote_size = -1;
> > p = rptp_parse(response, "size");
> > if (p)
> > remote_size = atoi(p);
> >
> > * Various malloc() without a check of failure, such as:
>
> These look like minor correctness and robustness issues.
Some of them may be minor, but ones in librplay may be a major
issue. For instance, in Debian, /usr/libexec/fvwm2/2.7.0/FvwmEvent
is linked against this library:
qaa:~> ldd /usr/libexec/fvwm2/2.7.0/FvwmEvent
[...]
librplay.so.3 => /lib/librplay.so.3 (0x00007f25461f4000)
[...]
meaning that this could make the window manager crash (unless it
has some protection for modules).
--
Vincent Lefèvre <vincent@...c17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
