From owner-freebsd-bugs  Tue Dec 11 20:19: 2 2001
Delivered-To: freebsd-bugs@freebsd.org
Received: from lennier.cc.vt.edu (lennier.cc.vt.edu [198.82.162.213])
	by hub.freebsd.org (Postfix) with ESMTP
	id 846B037B419; Tue, 11 Dec 2001 20:18:56 -0800 (PST)
Received: from zidane.cc.vt.edu (IDENT:mirapoint@zidane-lb.cc.vt.edu [10.1.1.13])
	by lennier.cc.vt.edu (8.11.4/8.11.4) with ESMTP id fBC4It1348440;
	Tue, 11 Dec 2001 23:18:55 -0500 (EST)
Received: from enterprise.muriel.penguinpowered.com (hc652647d.dhcp.vt.edu [198.82.100.125])
	by zidane.cc.vt.edu (Mirapoint)
	with ESMTP id AGF72152;
	Tue, 11 Dec 2001 23:18:54 -0500 (EST)
Message-ID: <XFMail.20011211231854.mheffner@vt.edu>
X-Mailer: XFMail 1.5.2 on FreeBSD
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="_=XFMail.1.5.2.FreeBSD:20011211231854:24503=_"
Date: Tue, 11 Dec 2001 23:18:54 -0500 (EST)
From: Mike Heffner <mheffner@vt.edu>
To: freebsd-gnats-submit@freebsd.org
Subject: Re: bin/19422: users can overflow argv to make ps segfault
Cc: Marc Olzheim <marcolz@ilse.nl>,
	FreeBSD-bugs <freebsd-bugs@freebsd.org>
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org

This message is in MIME format
--_=XFMail.1.5.2.FreeBSD:20011211231854:24503=_
Content-Type: text/plain; charset=us-ascii


Well, I've looked at this a little more. I was able to reproduce it (it
took a few times though). Unfortunately, the patch isn't as simple as the
one in the PR. Could you please try the attached patch? There is still a
problem though, and that is that the strlen()s can seg. fault if the
argv[] strings aren't NULL terminated - I don't know how to fix this
problem though :(

Mike

-- 
  Mike Heffner     <mheffner@[acm.]vt.edu>
  Blacksburg, VA       <mikeh@FreeBSD.org>


--_=XFMail.1.5.2.FreeBSD:20011211231854:24503=_
Content-Disposition: attachment; filename="ps.argoflow.diff"
Content-Transfer-Encoding: 7bit
Content-Description: ps.argoflow.diff
Content-Type: text/plain;
 charset=us-ascii; name=ps.argoflow.diff; SizeOnDisk=908

Index: fmt.c
===================================================================
RCS file: /home/ncvs/src/bin/ps/fmt.c,v
retrieving revision 1.14
diff -u -r1.14 fmt.c
--- fmt.c	27 Aug 1999 23:14:51 -0000	1.14
+++ fmt.c	12 Dec 2001 04:12:24 -0000
@@ -61,7 +61,8 @@
 shquote(argv)
 	char **argv;
 {
-	long arg_max;
+	static long arg_max = -1;
+	long len;
 	char **p, *dst, *src;
 	static char *buf = NULL;
 
@@ -80,13 +81,16 @@
 	for (p = argv; (src = *p++) != 0; ) {
 		if (*src == 0)
 			continue;
-		strvis(dst, src, VIS_NL | VIS_CSTYLE);
+		len = (4 * arg_max - (dst - buf)) / 4;
+		strvisx(dst, src, strlen(src) < len ? strlen(src) : len,
+		    VIS_NL | VIS_CSTYLE);
 		while (*dst)
 			dst++;
-		*dst++ = ' ';
+		if ((4 * arg_max - (dst - buf)) / 4 > 0)
+			*dst++ = ' ';
 	}
 	/* Chop off trailing space */
-	if (dst != buf)
+	if (dst != buf && dst[-1] == ' ')
 		dst--;
 	*dst = '\0';
 	return (buf);

--_=XFMail.1.5.2.FreeBSD:20011211231854:24503=_--
End of MIME message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message