-
Qualys Security Advisory authored
This is one of the worst issues that we found: if the strlen() of one of the cmdline arguments is greater than INT_MAX (it is possible), then the "int bytes" could wrap around completely, back to a very large positive int, and the next strncat() would be called with a huge number of destination bytes (a stack-based buffer overflow). Fortunately, every distribution that we checked compiles its procps utilities with FORTIFY, and the fortified strncat() detects and aborts the buffer overflow before it occurs. This patch also fixes a secondary issue: the old "--bytes;" meant that cmdline[sizeof (cmdline) - 2] was never written to if the while loop was never entered; in the example below, "ff" is the uninitialized byte: ((exec -ca `python3 -c 'print("A" * 131000)'` /usr/bin/cat < /dev/zero) | sleep 60) & pgrep -a -P "$!" 2>/dev/null | hexdump -C 00000000 31 32 34 36 30 20 41 41 41 41 41 41 41 41 41 41 |12460 AAAAAAAAAA| 00000010 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAAAAAA| * 00001000 41 41 41 41 ff 0a 31 32 34 36 32 20 73 6c 65 65 |AAAA..12462 slee| 00001010 70 20 36 30 0a |p 60.|
b51ca2a1