Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 29 Dec 2016 21:16:05 +0000
From:      bugzilla-noreply@freebsd.org
To:        freebsd-bugs@FreeBSD.org
Subject:   [Bug 213922] crafted data could cause qsort to exhaust stack space
Message-ID:  <bug-213922-8-qOV3G8ltIY@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-213922-8@https.bugs.freebsd.org/bugzilla/>
References:  <bug-213922-8@https.bugs.freebsd.org/bugzilla/>

next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D213922

--- Comment #3 from jhoward@alumni.utexas.net ---
Unfortunately I don't have a working FreeBSD environment to use.  This patch
came about because I pulled down the qsort code for a separate project (just
needed a good implementation to tinker with) and noticed the potential for =
the
recursion to be exploited using crafted sort data.

Can you point me to a reference on how to run the tests you mentioned?

I'll work on finding a FreeBSD VM I can use, and/or code to generate sort d=
ata
that breaks the existing qsort implementation.  That at least proves there'=
s an
issue.

Since the kernel also uses the same implementation, if someone could find a=
 way
to pass crafted sort data to the kernel version, I'd imagine there could be
security implications.

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-213922-8-qOV3G8ltIY>