patchGNU gv - Patches: patch #10096, potential buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10096: potential buffer overflow in resource.c

Submitter:  eqkws
Submitted:  Wed 18 Aug 2021 02:41:52 AM UTC
 
Category:  None Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open

Thu 19 Aug 2021 04:30:57 PM UTC, comment #1: 

I applied your buffer overflow patch to my clone at https://github.com/william8000/gv which has some other fixes.

William Bader <william8000>
Wed 18 Aug 2021 02:41:52 AM UTC, original submission:  

In src/resource.c, there are multiple potential buffer overflow vulnerabilities.

At line 202, the program gets the value of 'locale' from an environment variable.

------------------------------
202 locale = getenv("LC_ALL");
203 if ( !locale || !*locale )
204   locale = getenv("LC_MESSAGES");
205 if ( !locale || !*locale )
206   locale = getenv("LANG");
207 if ( !locale || !*locale )
208   locale = "C";
------------------------------

From 211 to 228, the string in 'locale' is stored to 'loc_lang'.
After that, sprintf calls use 'loc_lang' with no length check.
Since the size of 'locale1', 'local2' and 'locale3' are all fixed to 100
if a malicious attacker puts a large string to the environment variable, it may cause stack buffer overflow that leads to buggy behavior.

------------------------------
210 {
211   char* cL, * cP;
212
213   cP = loc_lang;
214   cL = locale;
215  
216   *loc_terr = 0;
217   *loc_cs = 0;
218   *loc_mod = 0;
219     
220   while (*cL)
221   {
222     if ( cL == '_' ) { cP = 0; cP = loc_terr; }
223     if ( cL == '.' ) { cP = 0; cP = loc_cs; }
224     if ( cL == '@' ) { cP = 0; cP = loc_mod; }
225       cP++ = cL++;
226     }
227     *cP = 0;
228   }
229
230   s = resource_getResource(db,app_class,app_name, "international",0);
231   if (s == NULL || !strcasecmp(s, "False"))
232   {
233     sprintf(locale1, "noint:%s%s", loc_lang, loc_terr);
234     sprintf(locale2, "noint:%s", loc_lang);
235     strcpy(locale3, "C");
236   }
237   else
238   {
239     strcpy(locale1, locale);
240     sprintf(locale2, "%s%s%s", loc_lang, loc_terr, loc_cs);
241     sprintf(locale3, "%s%s", loc_lang, loc_cs);
242   }
------------------------------

eqkws

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #51796:  patchfile added by eqkws (853B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by william8000 (Posted a comment)
  • -email is unavailable- added by eqkws (Submitted the item)
  • -email is unavailable- added by eqkws
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-18 eqkws Attached File- Added patchfile, #51796
    2021-08-18 eqkws Carbon-Copy- Added -email is unavailable-

    Back to the top


    Powered by Savane 3.9