From: Dave Jones <davej@redhat.com>
To: Ildar Muslukhov <ildarm@google.com>
Cc: trinity@vger.kernel.org
Subject: Re: stack smash detected bug
Date: Fri, 4 Oct 2013 13:17:09 -0400 [thread overview]
Message-ID: <20131004171709.GA28371@redhat.com> (raw)
In-Reply-To: <CAEGbLtuA81sypq9i2AUyEY89jErdLv6pk_ceaKFSggqBFDFsfQ@mail.gmail.com>
On Fri, Oct 04, 2013 at 10:11:04AM -0700, Ildar Muslukhov wrote:
> Here is an example that causes the crash, it is obviously longer that 512 ascii:
> [child0:1607] [31] utimensat(dfd=^[[1;36m497
> , filename=^[[1;36m".//proc/4/task/4/cpusetd%s%d%d%d%d%s%s%s%d%d%s%d%d%d%d%s%s%d
> %s%s%d%s%d%s%s%d%d%s%d%d%d%d%s%d%d%s%s%s%d%s%d%d%s%d%d%s%d%s%d%s%d%d%d%s%s%s%s%s
> %d%s%s%d%s%d%d%d%d%d%s%d%s%s%d%s%d%d%d%d%d%d%s%d%d%s%s%s%d%d%d%d%d%d%s%s%d%s%s%d
> %s%s%s%s%d%s%d%d%d%d%d%d%s%s%d%s%d%d%s%d%d%s%s%d%s%d%d%d%s%s%d%s%d%s%d%s%s%d%s%s
> %d%d%s%s%s%s%s%d%s%d%d%d%s%s%d%s%s%d%s%s%d%s%d%d%s%d%s%d%d%s%s%d%s%d%d%d%s%s%d%s
> %s%s%s%d%d%s%s%d%d%d%s%d%d%s%d%s%s%d%s%s%s%d%s%d%d%s%d%s%d%s%d%s%d%s%d%d%s%s%d%s
> %d%s%s%d%d%s%s%s%s%d%d%d%d%d%d%d%s%s%s%d%d%d%s%d%s%s%d%d%s%s%s%s%d%d%s%s%d%d%d%s
> %d%s%d%d%s%d%d%d%s%s%d%s%s%d%s%s%s%d%s%d%s%s%s%s%s%d%d%s%d%s%s%d%d%s%d%s%s%d%s%s
> %d%d%d%s%d%d%d%s%d%d%d%s%s%s%d%d%d%s%d%d%d%s%s%d%d%s%s%s%d%d%d%d%d%s%s%d%s%d%d%s
> %d%d%d%s%s%d%s%s%s%s%d%s%d%s%s%d%d%d%d%d%s%d%d%s%s%d%d%d%d%d%s%d%d%s%s%s%d%d%s%s
> %d%s%s%d%d%d%s%d%s%s%s%d%s%s%s%s%s%s%s%s%s%s%s%s%d%d%s%d%s%d%d%s%s%s%s%s%s%d%s%d
> %s%d%d%s%d%d%d%s%s%s%s%s%d%d%d%s%s%s%s%d%s%s%s%d%d%d%s%d%s%s%d%d%s%s%s%s%s%s%s%d
> %s%d%s%s%d%d%d%s%s%d%s%s%s%d%s%d%s%
> [child1:1608] [0] setreuid(ruid=0x400000000000000,
> euid=0xffffffffffffffff) [child1:1608] = -1 (Operation not permitted)
Ah, of course.. the pathname mangler. Oops.
This perhaps ?
Dave
diff --git a/syscall.c b/syscall.c
index 80f5a34..94d2f1b 100644
--- a/syscall.c
+++ b/syscall.c
@@ -222,9 +222,11 @@ long mkcall(int childno)
unsigned int call = shm->syscallno[childno];
unsigned long ret = 0;
int errno_saved;
- char string[512], *sptr;
+ char *string, *sptr;
uid_t olduid = getuid();
+ string = malloc(page_size);
+
shm->regenerate++;
sptr = string;
@@ -318,6 +320,9 @@ skip_args:
output(2, "%s\n", string);
+ free(string);
+
+
if (dopause == TRUE)
sleep(1);
next prev parent reply other threads:[~2013-10-04 17:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-04 1:53 stack smash detected bug Ildar Muslukhov
2013-10-04 15:29 ` Dave Jones
2013-10-04 17:11 ` Ildar Muslukhov
2013-10-04 17:17 ` Dave Jones [this message]
2013-10-04 17:30 ` Ildar Muslukhov
2013-10-04 17:40 ` Dave Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131004171709.GA28371@redhat.com \
--to=davej@redhat.com \
--cc=ildarm@google.com \
--cc=trinity@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox