[BusyBox 0004664]: ping6 accesses invalid memory

[bugs at busybox.net]

The following issue has been SUBMITTED. 
====================================================================== 
http://busybox.net/bugs/view.php?id=4664 
====================================================================== 
Reported By:                cristic
Assigned To:                BusyBox
====================================================================== 
Project:                    BusyBox
Issue ID:                   4664
Category:                   Other
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     assigned
====================================================================== 
Date Submitted:             08-19-2008 13:19 PDT
Last Modified:              08-19-2008 13:19 PDT
====================================================================== 
Summary:                    ping6 accesses invalid memory
Description: 
./ping6 -
accesses invalid memory

First, it calls ping6_main(argc=2, argv={"ping6", "-", 0}):

int ping6_main(int argc, char **argv)
{
	argv[0] = (char*)"-6";
	return ping_main(argc + 1, argv - 1);
}

ping_main then calls getopt32(argv, ...) which illegally dereferences
argv[0], that is, the old argv[-1], on line getopt32.c:347:

346:	argc = 0;
347:	while (argv[argc])
348:		argc++;

Thanks,
Cristian
====================================================================== 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
08-19-08 13:19  cristic        New Issue                                    
08-19-08 13:19  cristic        Status                   new => assigned     
08-19-08 13:19  cristic        Assigned To               => BusyBox         
======================================================================