[Bug libc/23913] New: off-by-one in function maybe_script_execute in sysdeps/posix/spawni.c

[yangx92 at hotmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23913

            Bug ID: 23913
           Summary: off-by-one in function maybe_script_execute in
                    sysdeps/posix/spawni.c
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: yangx92 at hotmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

There is an off-by-one vulnerability in function maybe_script_execute in
sysdeps/posix/spawni.c

 61 static void
 62 maybe_script_execute (struct posix_spawn_args *args)
 63 {
 64   if (SHLIB_COMPAT (libc, GLIBC_2_2, GLIBC_2_15)
 65       && (args->xflags & SPAWN_XFLAGS_TRY_SHELL) && errno == ENOEXEC)
 66     {
 67       char *const *argv = args->argv;
 68       ptrdiff_t argc = args->argc;
 69 
 70       /* Construct an argument list for the shell.  */
 71       char *new_argv[argc + 1];
 72       new_argv[0] = (char *) _PATH_BSHELL;
 73       new_argv[1] = (char *) args->file;
 74       if (argc > 1)
 75         memcpy (new_argv + 2, argv + 1, argc * sizeof(char *));
 76       else
 77         new_argv[2] = NULL;
 78 
 79       /* Execute the shell.  */
 80       args->exec (new_argv[0], new_argv, args->envp);
 81     }
 82 }

In function maybe_script_execute, the new_argv array is dynamically initialized
on stack with (argc + 1) elements. 
The function wants to add _PATH_BSHELL as the first argument and writes out of
bounds of new_argv.
There is an off-by-one because maybe_script_execute fails to count the
terminating NULL when sizing new_argv.

This issue is same to
https://sourceware.org/git/?p=glibc.git;a=commit;h=28669f86f6780a18daca264f32d66b1428c9c6f1.

-- 
You are receiving this mail because:
You are on the CC list for the bug.