From owner-freebsd-bugs Wed Oct 31 14:30:12 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 32E9337B40A for ; Wed, 31 Oct 2001 14:30:01 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f9VMU1i90804; Wed, 31 Oct 2001 14:30:01 -0800 (PST) (envelope-from gnats) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id AFAEE37B406 for ; Wed, 31 Oct 2001 14:29:22 -0800 (PST) Received: (from arr@localhost) by fledge.watson.org (8.11.6/8.11.5) id f9VMTGN88936; Wed, 31 Oct 2001 17:29:16 -0500 (EST) (envelope-from arr) Message-Id: <200110312229.f9VMTGN88936@fledge.watson.org> Date: Wed, 31 Oct 2001 17:29:16 -0500 (EST) From: "Andrew R. Reiter" Reply-To: "Andrew R. Reiter" To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 Subject: bin/31673: lack of bounds check on string functions after getenv() call. Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 31673 >Category: bin >Synopsis: lack of bounds check on string functions after getenv() call. >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Oct 31 14:30:00 PST 2001 >Closed-Date: >Last-Modified: >Originator: Andrew R. Reiter >Release: FreeBSD 5.0-CURRENT i386 >Organization: >Environment: System: FreeBSD rakahanga 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Mon Oct 29 06:39:1 1 GMT 2001 root@:/usr/obj/usr/src/sys/GENERIC i386 >Description: Essentially, after a call to getenv() in which the code wishes to receive the data for the TMPDIR key, it either will do a sprintf or strcpy depending on whether or not a NULL was returned from getenv(). The sprintf() could be overflowed.. the strcpy more than likely not. More specifically the problem is: char path[MAXPATHLEN]; if (!first && !envtmp) { envtmp = getenv("TMPDIR"); first = 1; } if (envtmp) (void)sprintf(path, "%s/%s", envtmp, _NAME_ARTMP); else strcpy(path, _PATH_ARTMP); >How-To-Repeat: >Fix: Index: misc.c =================================================================== RCS file: /home/ncvs/src/usr.bin/ar/misc.c,v retrieving revision 1.7 diff -u -r1.7 misc.c --- misc.c 24 Jul 2001 14:04:20 -0000 1.7 +++ misc.c 31 Oct 2001 14:11:17 -0000 @@ -73,9 +73,10 @@ } if (envtmp) - (void)sprintf(path, "%s/%s", envtmp, _NAME_ARTMP); + (void)snprintf(path, sizeof(path), "%s/%s", envtmp, + _NAME_ARTMP); else - strcpy(path, _PATH_ARTMP); + strlcpy(path, _PATH_ARTMP, sizeof(path)); sigfillset(&set); (void)sigprocmask(SIG_BLOCK, &set, &oset); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message