bugThe GNU Hurd - Bugs: bug #28446, No checks are made for unteminated...

 
 

bug #28446: No checks are made for unteminated strings in RPC messages

Submitted by:  Carl Fredrik Hammar <hammy>
Submitted on:  Wed 30 Dec 2009 07:42:20 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: OpenReproducibility: None
Size (loc): NonePlanned Release: None
Effort: 0.00
Wiki-like text discussion box: 

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 30 Dec 2009 07:42:20 PM UTC, original submission:

Strings in RPCs, such as the filename argument to a dir_lookup,
are not checked if they are terminated by '\0'. This could lead
to the server segfaulting if it tries to read the string.

Making MIG check that strings are terminated seems like the
proper fix.

I have attached a program that sends an unterminated dir_lookup to
its first argument, which can be used to test how translators
react. For instance, ext2fs reacts by sending ENAMETOOLONG.

Carl Fredrik Hammar <hammy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #19398:  unterm-path.c added by hammy (6kB - text/x-csrc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by hammy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 30 Dec 2009 07:42:20 PM UTChammyAttached File-=>Added unterm-path.c, #19398

    Back to the top


    Powered by Savane 3.1-cleanup