[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAJpB=GE_vgzy4sGFoBybfFD1O1Q+LWxc8RVurqmwAM6OCBzPeg@mail.gmail.com>
Date: Sat, 18 Oct 2025 13:01:30 -0700
From: Fabio Degrigis <degrigis@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: rplay (Mark R. Boyns) potential security issues
(unsanitized data, unchecked malloc...)
I can confirm I can trigger a SIGSEGV at
https://salsa.debian.org/alteholz/rplay/-/blob/master/librplay/rplay.c?ref_type=heads#L470
reachable from "rplay_unpack" with a simple harness.
This is indeed a bit concerning since these packets can potentially be
processed by the audio server with no authentication.
Fabio
Il giorno ven 17 ott 2025 alle ore 17:26 Vincent Lefevre <vincent@...c17.net>
ha scritto:
> On 2025-10-18 01:50:23 +0200, Solar Designer wrote:
> > On Sat, Oct 18, 2025 at 01:16:36AM +0200, Vincent Lefevre wrote:
> > > Debian distributes Mark R. Boyns's rplay 3.3.2. I've had
> > > a very quick look at the source and found at least:
> > >
> > > * In rplay/rplay.c line 600, the use of atoi() on something that
> > > looks like unsanitized data from a remote server:
> > >
> > > remote_size = -1;
> > > p = rptp_parse(response, "size");
> > > if (p)
> > > remote_size = atoi(p);
> > >
> > > * Various malloc() without a check of failure, such as:
> >
> > These look like minor correctness and robustness issues.
>
> Some of them may be minor, but ones in librplay may be a major
> issue. For instance, in Debian, /usr/libexec/fvwm2/2.7.0/FvwmEvent
> is linked against this library:
>
> qaa:~> ldd /usr/libexec/fvwm2/2.7.0/FvwmEvent
> [...]
> librplay.so.3 => /lib/librplay.so.3 (0x00007f25461f4000)
> [...]
>
> meaning that this could make the window manager crash (unless it
> has some protection for modules).
>
> --
> Vincent Lefèvre <vincent@...c17.net> - Web: <https://www.vinc17.net/>
> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
