Date: 20 Apr 2003 10:16:23 +0200 From: Sebastian Ssmoller <sebastian.ssmoller@web.de> To: Kris Kennaway <kris@obsecurity.org> Cc: current@FreeBSD.org Subject: Re: Buffer overflow in disklabel Message-ID: <1050826585.2052.12.camel@hadriel> In-Reply-To: <20030420032303.GA25568@rot13.obsecurity.org> References: <20030420032303.GA25568@rot13.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--=-XA6NYroOTWFV5e7PSWA6
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Hi,
I attached a patch for that problem. Can someone have a look at it?
But one thing is still unclear to me: Why do we need 8k buffer for the
disk name?
seb
Am Son, 2003-04-20 um 05.23 schrieb Kris Kennaway:
> Run the following under /bin/sh (not tcsh, which - still! - has a bug
> that causes the command to hang tcsh):
>
> # disklabel `perl -e 'print "a"x51200'`
> Segmentation fault (core dumped)
>
> The responsible code is:
>
> dkname = argv[0];
> if (dkname[0] != '/') {
> (void)sprintf(np, "%s%s%c", _PATH_DEV, dkname, 'a' + RAW_PART);
> specname = np;
> np += strlen(specname) + 1;
> } else
> specname = dkname;
> f = open(specname, op == READ ? O_RDONLY : O_RDWR);
> if (f < 0 && errno == ENOENT && dkname[0] != '/') {
> (void)sprintf(specname, "%s%s", _PATH_DEV, dkname);
> np = namebuf + strlen(specname) + 1;
> f = open(specname, op == READ ? O_RDONLY : O_RDWR);
> }
>
> i.e. overflowing an 8k buffer. Does anyone feel like fixing it?
>
> Kris
--=-XA6NYroOTWFV5e7PSWA6--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1050826585.2052.12.camel>