ericonr
/
util-linux
mirror of https://github.com/ericonr/util-linux.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

setproctitle: fix out of boundary access 

A program using setproctitle can trigger an out of boundary access
if an attacker was able to clear the environment before execution.

The check in setproctitle prevents overflows, but does not take into
account that the whole length of the arguments could be 1, which is
possible by supplying such a program name to execlp(3) or using a
symbolic link, e.g. argv[0] = "l", argv[1] = NULL.

Only login uses setproctitle, which is not affected by this
problem due to initializing the environment right before the call.
This commit is contained in:
Tobias Stoeckmann 2017-09-25 21:55:34 +02:00 committed by Karel Zak
parent f17bda66bd
commit c7f87da2ba
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/setproctitle.c
View File

@ -17,7 +17,7 @@
extern char **environ;
static char **argv0;
static int argv_lth;
static size_t argv_lth;
void initproctitle (int argc, char **argv)
{
@ -42,16 +42,17 @@ void initproctitle (int argc, char **argv)
return;
environ[i] = NULL;
argv0 = argv;
if (i > 0)
argv_lth = envp[i-1] + strlen(envp[i-1]) - argv0[0];
argv_lth = envp[i-1] + strlen(envp[i-1]) - argv[0];
else
argv_lth = argv0[argc-1] + strlen(argv0[argc-1]) - argv0[0];
argv_lth = argv[argc-1] + strlen(argv[argc-1]) - argv[0];
if (argv_lth > 1)
argv0 = argv;
}
void setproctitle (const char *prog, const char *txt)
{
int i;
size_t i;
char buf[SPT_BUFSIZE];
if (!argv0)