mainGnuTLS - Support: sr #107525, Use of dangerous/banned functions...

 
 

sr #107525: Use of dangerous/banned functions (Particular Instances)

Submitter:  Jeffrey Walton <noloader>
Submitted:  Fri 19 Nov 2010 12:00:16 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 19 Nov 2010 06:26:38 AM UTC, comment #1: 

I think all the places you noted could warrant more careful code reading and potential improvements if there is any chance of errors -- patches welcome.

/Simon

Simon Josefsson <jas>
Group administrator
Fri 19 Nov 2010 12:00:16 AM UTC, original submission:  

GnuTLS is using some functions which cannot indicate error; and other times the project is ignoring return values from known unsafe functions. The attached audit displays usage of strcpy, strncpy, strcat, strncat, sprintf, and vsprintf.

In many cases, the function in question does not return a useful return value*, so GnuTLS has no way of detecting abnormalities. It might not be appropriate to assume SUCCESS under all circumstances, especially in a hostile environment

Other functions return a value, but the return value is ignored - for example sprintf and snprintf in certtool.c. In the case of security software, it is often prudent to check return values in all cases where a value is available.

Attached is the jagged script used to generate the audit (enhancements welcome), and the results of the audit. A sample of the audit follows.

===== certtool.c =====
124: sprintf (&(buf[i * 3]), "%02X%s", raw[i],
===== cli.c =====
876: strcpy (b, "\r\n");
===== common.c =====
64: sprintf (&(buf[i * 3]), "%02X%s", raw[i],
===== crypt.c =====
165: strcpy (_salt, salt);
578: strcpy (tmpname, tpasswd);
579: strcat (tmpname, ".tmp");
131: sprintf (line, "%d:%s:%s\n", index, str_n.data, str_g.data);
511: sprintf (result, "%s:%s", txt_verifier.data, txt_salt.data);
....

==========

  • For example, strcpy(3) man page states (Ubuntu 10.x):

    RETURN VALUE: The  strcpy()  and strncpy() functions return a pointer
    to the destination string dest.

man pages typically under-play the return value. From The Open Group Base Specifications (http://www.opengroup.org/onlinepubs/009695399/functions/strcpy.html):

    RETURN VALUE: The strcpy() function shall return s1; no return value
    is reserved to indicate an error.

Jeffrey Walton <noloader>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #22055:  audit-unsafe-fns.txt added by noloader (3KiB - text/plain)
file #22054:  audit-unsafe.sh added by noloader (808B - application/x-sh)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Updated the item)
  • -email is unavailable- added by jas (Posted a comment)
  • -email is unavailable- added by noloader (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-04-10 nmav StatusNone Done
        Assigned toNone nmav
        Open/ClosedOpen Closed
    2010-11-19 noloader Attached File- Added audit-unsafe-fns.txt, #22055
        Attached File- Added audit-unsafe.sh, #22054

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code