From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.2 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by inbox.vuxu.org (OpenSMTPD) with SMTP id cb70f8ee for ; Thu, 13 Feb 2020 23:21:17 +0000 (UTC) Received: (qmail 22197 invoked by uid 550); 13 Feb 2020 23:21:16 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 22179 invoked from network); 13 Feb 2020 23:21:15 -0000 Date: Thu, 13 Feb 2020 18:21:03 -0500 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20200213232103.GJ1663@brightrain.aerifal.cx> References: <6ead5f7b-d645-5df0-cb06-a99178471a96@bell-sw.com> <20200213201103.GB3383@voyager> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200213201103.GB3383@voyager> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: Rich Felker Subject: Re: [musl] execvp() behaviour with unrecognized file header On Thu, Feb 13, 2020 at 09:11:03PM +0100, Markus Wichmann wrote: > Hi all, > > so I had a look around at other implementations, since I thought the > problem might be a solved one, and here's what I found: > > newlib does not support this behavior at all. > > bionic uses a VLA for the new argv[]. I didn't even know C++ had VLAs, > so at least I learned something from this. > > glibc also uses a VLA. > > klibc also does not support this behavior. > > uclibc-ng is an interesting one. On architectures with MMU they allocate > the necessary space with alloca(), but without an MMU, they will use > mmap() directly to try and minimize the memory leak, as a comment > directly before the code responsible tells us. This makes no sense. alloca does not cause any memory leak; it just blows away the stack if the stack isn't sufficiently large. On the other hand mmap is a memory leak without some dirty tricks to get rid of the leak. You could either use synchronization, taking advantage of shared memory with parent, to allocate a single mmap that's reused (and possibly resized) every time there's a vfork child calling execvp, but otherwise left around (bounded usage so not a "leak"), or you could stick a hook in the parent side of vfork that checks for a thread-local mmap execvp buffer pointer and unmaps it before return in the parent if it's found. > So yeah, the competition appears to either not bother or just use VLAs. > I guess it is not a huge problem in practice? Using VLAs is worse than not supportint it at all -- it's an exploitable vuln. Rich