aa-status: segfault if profile name contains \n
If a profile name contains \n
, calling aa-status results in
# aa-status
apparmor module is loaded.
Segmentation fault (core dumped)
dmesg says:
[14464.925056] aa-status[27600]: segfault at 0 ip 00007f53b851357d sp 00007ffeca9ed038 error 4 in libc.so.6[7f53b83b1000+182000]
[14464.925066] Code: f8 77 c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 33 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 57 f3 0f bc c0 c5 f8 77 c3 66 66
Backtrace:
Stack trace of thread 26430:
#0 0x00007fba7049957d __strlen_avx2 (libc.so.6 + 0x1a157d)
#1 0x00007fba703afb03 __strdup (libc.so.6 + 0xb7b03)
#2 0x000055f0921aae16 get_profiles (aa-status + 0x2e16)
#3 0x000055f0921ab508 detailed_output (aa-status + 0x3508)
#4 0x000055f0921aa476 main (aa-status + 0x2476)
#5 0x00007fba703385c0 __libc_start_call_main (libc.so.6 + 0x405c0)
#6 0x00007fba7033867c __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x4067c)
#7 0x000055f0921aa555 _start (aa-status + 0x2555)
Reproducer: run the attached reproducer.sh script: reproducer.sh
Tested with aa-status from 3.0.3 and master, same segfault.