Buffer overflow in disklabel

From: Kris Kennaway <kris_at_obsecurity.org>
Date: Sat, 19 Apr 2003 20:23:03 -0700
Run the following under /bin/sh (not tcsh, which - still! - has a bug
that causes the command to hang tcsh):

# disklabel `perl -e 'print "a"x51200'`
Segmentation fault (core dumped)

The responsible code is:

        dkname = argv[0];
        if (dkname[0] != '/') {
                (void)sprintf(np, "%s%s%c", _PATH_DEV, dkname, 'a' + RAW_PART);
                specname = np;
                np += strlen(specname) + 1;
        } else
                specname = dkname;
        f = open(specname, op == READ ? O_RDONLY : O_RDWR);
        if (f < 0 && errno == ENOENT && dkname[0] != '/') {
                (void)sprintf(specname, "%s%s", _PATH_DEV, dkname);
                np = namebuf + strlen(specname) + 1;
                f = open(specname, op == READ ? O_RDONLY : O_RDWR);
        }

i.e. overflowing an 8k buffer.  Does anyone feel like fixing it?

Kris
Received on Sat Apr 19 2003 - 18:23:05 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:04 UTC