[BusyBox] bug report (?)

[Vladimir N. Oleynik]

Gerardo,

> - In the file insmod.c there's another buffer overflow. Actually, there
>   are two different overflows there, both located in insmod_main(). The
>   first one starts in line 3267.
> 
>   insmod.c:3264         if ((tmp = strrchr(argv[optind], '/')) != NULL) {
>   insmod.c:3265                 tmp++;
>   insmod.c:3266         } else {
>   insmod.c:3267                 tmp = argv[optind];
>   insmod.c:3268         }
>   insmod.c:3269         len = strlen(tmp);
>   insmod.c:3271         if (len > 2 && tmp[len - 2] == '.' && tmp[len - 1]
> == 'o')
>   insmod.c:3272                 len -= 2;
>   insmod.c:3273         memcpy(m_fullname, len);
>   insmod.c:3274         m_fullname[len] = '\0';
> 
>   The module name is extracted from it's path in line 3264 and assigned to tmp.
>   Then it's lenght is found out, but only to be used when taking the ".o"
>   off the name. At last, memcpy copies what's left from the name to m_fullname
>   but doesn't check if it fits in there. Thus, if the remmanent name is longer
>   than FILENAME_MAX+1 bytes (which is the size of m_fullname), the buffer will
> be
>   overflown.
>   The second overflow is inmediatly after this one; the buffer being overflown
>   is m_name, which is also FILENAME_MAX+1 bytes long.
> 
>   insmod.c:3275         if (*m_name == '\0') {
>   insmod.c:3276                 strcpy(m_name, m_fullname);
>   insmod.c:3277         }
>   isnmod.c:3278         strcat(m_name, ".o");
> 
>   If an output module name was not given using "-o", m_name will be always a
>   void string when the program gets to line 3273. That being the case,
>   m_fullname will be copied into m_name. Since m_fullname can have an arbitrary
>   lenght, even bigger than FILENAME_MAX+1 bytes, m_name can be overflown using
>   m_fullname. Note that m_name cannot be overflown using the -o option,
>   since strncpy() was used there. m_name is declared inside insmod_main(),
>   thus this can be used to perform a stack overflow.
>   This can be exploited... sometimes. Since a lot of data beyond m_fullname
>   must be overwritten in order to later reach the return address when
>   overflowing m_name, sometimes the program will die signaled by SIGSEGV
>   while memcpy()'ing. It depends on the options used when compiling busybox.

Look last patch for the "insmod". 
I have tried to compensate addition of the size. 
The increase of the size is basic my stimulus to correct applets ;)

$ size insmod.o insmod_old.o
   text    data     bss     dec     hex filename
  13219      16    4128   17363    43d3 insmod.o
  13316      16    8224   21556    5434 insmod_old.o

Agree?



--w
vodz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: last_patch45.gz
Type: application/octet-stream
Size: 1512 bytes
Desc: not available
Url : http://lists.busybox.net/pipermail/busybox/attachments/20020613/b3d4bd10/attachment.obj