The following test program should crash Fiwix:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
char longarg[128 * 4096 + 1];
int main() {
char *argv[] = { "cat", NULL, NULL };
char *envp[] = { NULL };
memset(longarg, 'a', 128 * 4096);
argv[1] = longarg;
int err = execve("cat", argv, envp);
printf("errno is %d\n", errno);
printf("err is %d\n", err);
}
While there is argument and environment length checking in Fiwix, the checking is done too late to prevent the problem.
The GNU autoconf tool can perform checks that try to determine the maximum argument length that can be passed to a program, which triggers this crash.
A PR with a suggested fix is forthcoming.
The following test program should crash Fiwix:
While there is argument and environment length checking in Fiwix, the checking is done too late to prevent the problem.
The GNU autoconf tool can perform checks that try to determine the maximum argument length that can be passed to a program, which triggers this crash.
A PR with a suggested fix is forthcoming.