Re: TORCS 1.3.2 stack based buffer overflow

--===============0592924691389829710==
Content-Type: multipart/alternative; boundary=20cf30207984d2ba9a04b9413366

--20cf30207984d2ba9a04b9413366
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Ok!

2012/2/8 Bernhard Wymann <[email protected]>

> Hi Andres
>
> Fixed on r1-3-1 branch (cvs co -r r1-3-1 -P torcs). I will continue soon
> with the other printf's.
>
>
> Best regards
>
> Bernhard
>
> On 02/03/2012 05:00 PM, Andres Gomez wrote:
>
>> Hi Bernhard,
>>
>> I have found another exploitable buffer overflow in torcs, this time it
>> does'nt have relation with plib.
>> The problem is in:
>>
>> torcs/src/modules/graphic/**ssgraph/grsound.cpp, line 103:
>>
>> 96     char filename[512];
>>         FILE *file =3D NULL;
>>
>>         // ENGINE PARAMS
>>         tdble rpm_scale;
>>         param =3D GfParmGetStr(handle, "Sound", "engine sample",
>> "engine-1.wav");
>>         rpm_scale =3D GfParmGetNum(handle, "Sound", "rpm scale", NULL, 1=
.0);
>> 103   sprintf (filename, "cars/%s/%s", car->_carName, param);
>>         file =3D fopen(filename, "r");
>>         if (!file)
>>         {
>> 107             sprintf (filename, "data/sound/%s", param);
>>         }
>>         else
>>         {
>>             fclose(file);
>>         }
>>
>> As you know this section reads a configuration sound option from
>> [any-car].xml, for example:
>>
>> <section name=3D"Sound">
>> <attstr name=3D"engine sample" val=3D"renault-v10.wav"/>
>> <attnum name=3D"rpm scale" val=3D"0.35"/>
>> </section>
>>
>> if audio file name in "engine sample" is enough long it could overwrite
>> "filename" buffer (line 96),
>> because there is not size validation in line 103 (also in line 107).
>> Solution would be again to use snprintf taking care of buffer's size
>> (512).
>>
>> Any question is welcome ;)
>>
>> Regards.
>>
>> Andr=E9s G=F3mez
>>
>
>

--20cf30207984d2ba9a04b9413366
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Ok!<br><br><div class=3D"gmail_quote">2012/2/8 Bernhard Wymann <span dir=3D=
"ltr">&lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt;</s=
pan><br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex">

Hi Andres<br>
<br>
Fixed on r1-3-1 branch (cvs co -r r1-3-1 -P torcs). I will continue soon wi=
th the other printf&#39;s.<div class=3D"im HOEnZb"><br>
<br>
Best regards<br>
<br>
Bernhard<br>
<br>
On 02/03/2012 05:00 PM, Andres Gomez wrote:<br>
</div><div class=3D"HOEnZb"><div class=3D"h5"><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex=
">
Hi Bernhard,<br>
<br>
I have found another exploitable buffer overflow in torcs, this time it<br>
does&#39;nt have relation with plib.<br>
The problem is in:<br>
<br>
torcs/src/modules/graphic/<u></u>ssgraph/grsound.cpp, line 103:<br>
<br>
96 =A0 =A0 char filename[512];<br>
 =A0 =A0 =A0 =A0 FILE *file =3D NULL;<br>
<br>
 =A0 =A0 =A0 =A0 // ENGINE PARAMS<br>
 =A0 =A0 =A0 =A0 tdble rpm_scale;<br>
 =A0 =A0 =A0 =A0 param =3D GfParmGetStr(handle, &quot;Sound&quot;, &quot;en=
gine sample&quot;,<br>
&quot;engine-1.wav&quot;);<br>
 =A0 =A0 =A0 =A0 rpm_scale =3D GfParmGetNum(handle, &quot;Sound&quot;, &quo=
t;rpm scale&quot;, NULL, 1.0);<br>
103 =A0 sprintf (filename, &quot;cars/%s/%s&quot;, car-&gt;_carName, param)=
;<br>
 =A0 =A0 =A0 =A0 file =3D fopen(filename, &quot;r&quot;);<br>
 =A0 =A0 =A0 =A0 if (!file)<br>
 =A0 =A0 =A0 =A0 {<br>
107 =A0 =A0 =A0 =A0 =A0 =A0 sprintf (filename, &quot;data/sound/%s&quot;, p=
aram);<br>
 =A0 =A0 =A0 =A0 }<br>
 =A0 =A0 =A0 =A0 else<br>
 =A0 =A0 =A0 =A0 {<br>
 =A0 =A0 =A0 =A0 =A0 =A0 fclose(file);<br>
 =A0 =A0 =A0 =A0 }<br>
<br>
As you know this section reads a configuration sound option from<br>
[any-car].xml, for example:<br>
<br>
&lt;section name=3D&quot;Sound&quot;&gt;<br>
&lt;attstr name=3D&quot;engine sample&quot; val=3D&quot;renault-v10.wav&quo=
t;/&gt;<br>
&lt;attnum name=3D&quot;rpm scale&quot; val=3D&quot;0.35&quot;/&gt;<br>
&lt;/section&gt;<br>
<br>
if audio file name in &quot;engine sample&quot; is enough long it could ove=
rwrite<br>
&quot;filename&quot; buffer (line 96),<br>
because there is not size validation in line 103 (also in line 107).<br>
Solution would be again to use snprintf taking care of buffer&#39;s size (5=
12).<br>
<br>
Any question is welcome ;)<br>
<br>
Regards.<br>
<br>
Andr=E9s G=F3mez<br>
</blockquote>
<br>
</div></div></blockquote></div><br>

--20cf30207984d2ba9a04b9413366--


--===============0592924691389829710==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Virtualization & Cloud Management Using Capacity Planning
Cloud computing makes use of virtualization - but cloud computing 
also focuses on allowing computing to be delivered as a service.
http://www.accelacomm.com/jaw/sfnl/114/51521223/
--===============0592924691389829710==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Torcs-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/torcs-devel

--===============0592924691389829710==--