bugmake - Bugs: bug #59601, buffer over-read on malformed...

 
 

bug #59601: buffer over-read on malformed environment variable

Submitter:  eric lagergren <elagergren_so>
Submitted:  Wed 02 Dec 2020 08:00:31 PM UTC
   
 
Severity:  3 - Normal Item Group:  Bug
Status:  Fixed Privacy:  Public
Assigned to:  psmith Open/Closed:  Closed
Component Version:  4.3 Operating System:  Any
Fixed Release:  4.4 Triage Status:  Small Effort
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 06 Dec 2020 03:10:22 PM UTC, comment #3: 

Thanks Dmitry; I had that fix already in my queue.  I've pushed it to Git now and it will be in the next release.  Thanks for the report!

Paul D. Smith <psmith>
Group administrator
Sat 05 Dec 2020 02:29:53 PM UTC, comment #2: 

Thanks for your report. Here is a patch.

diff --git a/src/main.c b/src/main.c
index 9066513..64e2529 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1364,7 +1364,7 @@ main (int argc, char *argv, char *envp)
         enum variable_export export = v_export;
         size_t len;
 
-        while (! STOP_SET (*ep, MAP_EQUALS))
+        while (! STOP_SET (*ep, MAP_EQUALS|MAP_NUL))
           ++ep;
 
         /* If there's no equals sign it's a malformed environment.  Ignore.  */

Dmitry Goncharov <dgoncharov>
Wed 02 Dec 2020 08:07:48 PM UTC, comment #1: 

This seems to be eight years old: https://git.savannah.gnu.org/cgit/make.git/diff/main.c?id=cc85b927cdc1a4dad3217842215903a45044fc43

Indeed, checking whether *ep is NULL fixes the bug.

eric lagergren <elagergren_so>
Wed 02 Dec 2020 08:00:31 PM UTC, original submission:  

If Make encounters an environment variable without an equals sign it will read past the end of `ep` (on 4.3, main.c:1364).

To repro, compile then provide the path to `make`:


#include <stdio.h>
#include <unistd.h>

int main(int argc, const char** argv) {
    if (argc != 2) {
        fprintf(stderr, "test.c: must provide exactly one argument\n");
        return 1;
    }
    char* const args[] = {NULL};
    char* const envp[] = {"CRASH", NULL};
    execve(argv[1], args, envp);
    perror("execve");
    return 0;
}


Tested Make versions 4.2.1 (default on Debian Buster), 4.3.1 (compiled from source on Debian Buster), and 3.81 (macOS 19.6.0).

eric lagergren <elagergren_so>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #50381:  repro.go added by elagergren_so (258B - application/octet-stream)
file #50380:  repro.c added by elagergren_so (343B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by psmith (Posted a comment)
  • -email is unavailable- added by dgoncharov (Posted a comment)
  • -email is unavailable- added by elagergren_so (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-12-06 psmith StatusNone Fixed
        Assigned toNone psmith
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.4
        Triage StatusNone Small Effort
    2020-12-02 elagergren_so Carbon-CopyRemoved elagergren_so -
    2020-12-02 elagergren_so Attached File- Added repro.go, #50381
    2020-12-02 elagergren_so Carbon-Copy- Added elagergren_so
    2020-12-02 elagergren_so Attached File- Added repro.c, #50380

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code