Skip to content

Commit 0ddee9b

Browse files
Sergei Trofimovichwilliamh
authored andcommitted
openrc-init: fix buffer overflow in init.ctl
How to reproduce 1-byte overflow: ``` $ FEATURES=-test CFLAGS="-fsanitize=address -O0 -ggdb3" emerge -1 openrc ================================================================= ==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff0efd8710 at pc 0x000000402076 bp 0x7fff0efd7d50 sp 0x7fff0efd7d40 WRITE of size 1 at 0x7fff0efd8710 thread T0 #0 0x402075 (/sbin/openrc-init+0x402075) #1 0x3cf6e2070f in __libc_start_main (/lib64/libc.so.6+0x3cf6e2070f) #2 0x4013b8 (/sbin/openrc-init+0x4013b8) Address 0x7fff0efd8710 is located in stack of thread T0 at offset 2432 in frame #0 0x401cfb (/sbin/openrc-init+0x401cfb) This frame has 3 object(s): [32, 160) 'signals' [192, 344) 'sa' [384, 2432) 'buf' <== Memory access at offset 2432 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow ??:0 ?? ``` The problem here is in the code handling reads from 'init.ctl': ``` int main(int argc, char **argv) { ... char buf[2048]; for (;;) { /* This will block until a command is sent down the pipe... */ fifo = fopen(RC_INIT_FIFO, "r"); count = fread(buf, 1, 2048, fifo); buf[count] = 0; ... } ``` `buf[count] = 0;` writes outside the buffer when `fread()` returns non-truncated read. This fixes #138.
1 parent 688566c commit 0ddee9b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/rc/openrc-init.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ int main(int argc, char **argv)
195195
perror("fopen");
196196
continue;
197197
}
198-
count = fread(buf, 1, 2048, fifo);
198+
count = fread(buf, 1, sizeof(buf) - 1, fifo);
199199
buf[count] = 0;
200200
fclose(fifo);
201201
printf("PID1: Received \"%s\" from FIFO...\n", buf);

0 commit comments

Comments
 (0)