This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG

From: Paul Eggert <eggert at cs dot ucla dot edu>
To: Alex <alexinbeijing at gmail dot com>
Cc: libc-alpha at sourceware dot org
Date: Mon, 10 Aug 2015 02:03:26 -0700
Subject: Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
Authentication-results: sourceware.org; auth=none
References: <1439153945-22973-1-git-send-email-alexinbeijing at gmail dot com> <87fv3s83td dot fsf at igel dot home> <CACsECNf6dB8cAG4EHpox=tg8=+SbeWTb9J=T4zArLtmdQjqkHQ at mail dot gmail dot com> <CACsECNeWcACbJ50wYcrWL804G9o7T8eZT57oFZWS17jVZ98SxA at mail dot gmail dot com> <mvmzj1zmssr dot fsf at hawking dot suse dot de> <CACsECNcLeZW7WnC1mOM7AssN8xatAAHhEOnPAv9VUnup_cmU=Q at mail dot gmail dot com>

Alex wrote:

I've been trying to figure
out why the original author used strndupa in the first place but
haven't wrapped my mind around it yet.

Presumably the original author didn't know about "%.*s". The string is notnull-terminated, so "%s" won't work, and I guess the original author usedstrndupa to create a null-terminated copy.


Beware of int overflow when using "%.*s", by the way.

Follow-Ups:
- Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Andreas Schwab
- Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Alex

References:
- [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Alex Dowad
- Re: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Andreas Schwab
- Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Alex
- Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Andreas Schwab
- Re: Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG
  - From: Alex

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]