Skip to content

v2.3.1 - The one that can't run hooks

Choose a tag to compare

@ThatHackerDudeFromCyberspace ThatHackerDudeFromCyberspace released this 22 Oct 10:02
· 20 commits to rewrite-lite since this release

Hotfix v2.3.1 fixes a bug in sh_integration which manifested as scriptlets not appearing and constant crahs dumps.
I appologise for the inconvenience

Technical Info

  • When a scriptlet is passed to the sh_integration extractor to index, the header must be read
  • Reading the header happens in code similar to such:
buffer[0] = '\0';
int lineLength = 0;
char c;
while ((c = fgetc(file)) != EOF)
{
    if (c == '\n' || c == '\r')
    {
        break;
    }

    if (lineLength + 2 >= bufferSize)
    {
        buffer = realloc(buffer, bufferSize+=(lineLength + 2));
        if (buffer == NULL)
        {
            printf("FATAL - FAILED TO REALLOC BUFFER!!!\n");
            return; //@TODO: We don't really have a good way of dealing with this
        }
    }

    buffer[lineLength++] = c;
}
buffer[lineLength] = '\0';
  • This code was also wrapped to terminate after 6 lines
  • Unfortunately, using char c is incorrect, as that causes the EOF comparison to fail
  • As a result of this, the extractor will continue to reallocate until it OOMs and crashes the scanner, leading to the symptom of a scriptlet not appearing
  • This was switched to int c which fixed the bug

The crash dumps

  • It is still unknown why the sh_integration syslog function was causing constant scanner crashes
  • It has been removed in v2.3.1 for this reason

Why didn't tests catch this?

  • Unknown, neither of these issues happened on my laptop for some reason
  • Let me know if you do know though