Re: Heap-based Buffer Overflow in logger
Simon Josefsson via Bug reports for the GNU Internet utilities <[email protected]>
| Newsgroups | gmane.comp.gnu.inetutils.bugs |
|---|---|
| Message-ID | <[email protected]> |
AiDai <[email protected]> writes: > 0x60c00000003f is located 1 bytes to the left of 120-byte region Nice catch! Reproducing it is easy: jas@latte:~/src/inetutils$ valgrind src/logger -s '' ... ==339979== Invalid read of size 1 ==339979== at 0x10AA71: send_to_syslog (logger.c:329) ==339979== by 0x10A5CD: main (logger.c:504) ==339979== Address 0x4a343ef is 1 bytes before a block of size 1 alloc'd ==339979== at 0x483877F: malloc (vg_replace_malloc.c:307) ==339979== by 0x10CB08: xmalloc (xmalloc.c:44) ==339979== by 0x10A57D: main (logger.c:494) Writing a self-check for it is harder though, since the tool doesn't crash. Fixed by this patch: https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=8e0df0e80b156a09ff361050bac38bbdcda03aef /Simon
signature.asc
(application/pgp-signature, 255 B)
-----BEGIN PGP SIGNATURE----- iIoEARYIADIWIQSjzJyHC50xCrrUzy9RcisI/kdFogUCYsdU6hQcc2ltb25Aam9z ZWZzc29uLm9yZwAKCRBRcisI/kdForMlAP9A7g66/8kuZE0VwBxf1jLxTTy4sSkI NagHX3MuZ9NvQwD/XjBF2sk3nCWUdBT+7W53u6YJ3WVyumaZdsomGE1xCAI= =QvVD -----END PGP SIGNATURE-----