bugGNU Octave - Bugs: bug #47976, str2num can perform arbitrary code

 
 

bug #47976: str2num can perform arbitrary code

Submitted by:  None
Submitted on:  Sun 22 May 2016 02:52:52 PM UTC  
 
Category: Octave FunctionSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Matlab Compatibility
Status: Wont FixAssigned to: None
Originator Name: Andrew ThorntonOriginator Email: -unavailable-
Open/Closed: ClosedRelease: dev
Operating System: Any

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 22 May 2016 05:50:37 PM UTC, comment #3:

According to the Matlab docs for str2num:

>> Note str2num uses the eval function to convert the input
>> argument. Side effects can occur if the string contains calls
>> to functions. Using str2double can avoid some of these side
>> effects.


https://www.mathworks.com/help/matlab/ref/str2num.html

So str2num is behaving according to design I think.

Mike Miller <mtmiller>
Project Administrator
Sun 22 May 2016 05:41:35 PM UTC, comment #2:

So on looking a little further, matlab is not much better.

will cause it to exit.

The trouble is that str2num is supposed to be able to call functions by design.

Anonymous
Sun 22 May 2016 03:59:36 PM UTC, comment #1:

Also valid for the development version.

Just a hint: str2double() is much faster than str2num.m and doesn't have this issue.

Philip Nienhuis <philipnienhuis>
Project Member
Sun 22 May 2016 02:52:52 PM UTC, original submission:

The current implementation of str2num uses eval to convert the provided string into a number and does so without any escaping. This allows arbitrary code to be run, for example:

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mtmiller (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 22 May 2016 05:50:37 PM UTCmtmillerStatusConfirmed=>Wont Fix
      Open/ClosedOpen=>Closed
    Sun 22 May 2016 03:59:36 PM UTCphilipnienhuisStatusNone=>Confirmed
      Release4.0.2=>dev

    Back to the top


    Powered by Savane 3.1-cleanup1