* [9front] commit df04ea8d6c2e1e75307a77f2b086a836f480ab72
@ 2021-07-28 19:38 Anthony Martin
2021-07-28 22:55 ` cinap_lenrek
0 siblings, 1 reply; 2+ messages in thread
From: Anthony Martin @ 2021-07-28 19:38 UTC (permalink / raw)
To: 9front
+char bin[] = "/bin";
...
char buf[32];
...
+ buf[0] = '/';
+ buf[1+read(open("/env/cputype", OREAD|OCEXEC), buf+1, sizeof buf - 5)] = '\0';
+ strcat(buf, bin);
+ bind(buf, bin, MAFTER);
That's an out of bounds write if $cputype has a
length greater than or equal to (sizeof buf - 5):
strcat will write a NUL just past the end of buf.
Should be sizeof buf - 6.
Cheers,
Anthony
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [9front] commit df04ea8d6c2e1e75307a77f2b086a836f480ab72
2021-07-28 19:38 [9front] commit df04ea8d6c2e1e75307a77f2b086a836f480ab72 Anthony Martin
@ 2021-07-28 22:55 ` cinap_lenrek
0 siblings, 0 replies; 2+ messages in thread
From: cinap_lenrek @ 2021-07-28 22:55 UTC (permalink / raw)
To: 9front
> That's an out of bounds write if $cputype has a
> length greater than or equal to (sizeof buf - 5):
> strcat will write a NUL just past the end of buf.
yeah, you'r right! good catch!
aaand fixed.
--
cinap
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-07-29 3:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-28 19:38 [9front] commit df04ea8d6c2e1e75307a77f2b086a836f480ab72 Anthony Martin
2021-07-28 22:55 ` cinap_lenrek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).