bugGNU Octave - Bugs: bug #47976, str2num can perform arbitrary code

 
 

bug #47976: str2num can perform arbitrary code

Submitter:  None
Submitted:  Sun 22 May 2016 02:52:52 PM UTC
   
 
Category:  Octave Function Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Matlab Compatibility
Status:  Wont Fix Assigned to:  None
Originator Name:  Andrew Thornton Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * dev
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 22 May 2016 05:50:37 PM UTC, comment #3: 

According to the Matlab docs for str2num:

>> Note   str2num uses the eval function to convert the input
>> argument. Side effects can occur if the string contains calls
>> to functions. Using str2double can avoid some of these side
>> effects.


https://www.mathworks.com/help/matlab/ref/str2num.html

So str2num is behaving according to design I think.

Mike Miller <mtmiller>
Group Member
Sun 22 May 2016 05:41:35 PM UTC, comment #2: 

So on looking a little further, matlab is not much better.


str2num(['evalc(' char(39) 'exit' char(39) ')'])


will cause it to exit.

The trouble is that str2num is supposed to be able to call functions by design.

Anonymous
Sun 22 May 2016 03:59:36 PM UTC, comment #1: 

Also valid for the development version.

Just a hint: str2double() is much faster than str2num.m and doesn't have this issue.

Philip Nienhuis <philipnienhuis>
Group Member
Sun 22 May 2016 02:52:52 PM UTC, original submission:  

The current implementation of str2num uses eval to convert the provided string into a number and does so without any escaping. This allows arbitrary code to be run, for example:


str2num('];exit;[')



Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-03-01 mtmiller Carbon-CopyRemoved 80942 -
    2016-05-22 mtmiller StatusConfirmed Wont Fix
        Open/ClosedOpen Closed
    2016-05-22 philipnienhuis StatusNone Confirmed
        Release4.0.2 dev

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code