This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG


Alex <alexinbeijing@gmail.com> writes:

> On Mon, Aug 10, 2015 at 1:01 AM, Andreas Schwab <schwab@linux-m68k.org> wrote:
>> Alex Dowad <alexinbeijing@gmail.com> writes:
>>
>>> diff --git a/elf/rtld.c b/elf/rtld.c
>>> index 6dcbabc..ee194a6 100644
>>> --- a/elf/rtld.c
>>> +++ b/elf/rtld.c
>>> @@ -2408,6 +2408,8 @@ process_dl_debug (const char *dl_debug)
>>>             char *copy = strndupa (dl_debug, len);
>>>             _dl_error_printf ("\
>>>  warning: debug option `%s' unknown; try LD_DEBUG=help\n", copy);
>>
>> Use %.*s instead.
>
> Thanks for your reply. That would help to avoid potentially voluminous
> output to the console, but doesn't fix the (potential) security hole
> of copying an arbitrary, attacker-supplied string onto the stack.

You don't need the copy any more.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]