[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAGUWgD8zb-UEWp8TVHDSbo=iaCU4gWqnJHCFSPiR0fQWS73gPg@mail.gmail.com>
Date: Tue, 7 Feb 2023 16:45:16 +0200
From: Georgi Guninski <gguninski@...il.com>
To: oss-security@...ts.openwall.com
Subject: SEGV in `alloca(BIG)` and `long pl[BIG]`
Hi v3nd0rz crowd.
Inline are two C warez, which crash on
`alloca(BIG)` and `long pl[BIG]`.
I think alloca(BIG) should return error if BIG>max_signed_size_t.
In C++ `new[BUG]` throws exception and core dumps.
===
#include <stdlib.h>
#include <stdio.h>
#include <alloca.h>
/*
* Author: Georgi Guninski
* CV: https://j.ludost.net/resumegg.pdf
[joro@...ora prim]$ gcc alloca1.c
[joro@...ora prim]$ ./a.out -1
calloc=(nil) alloca()=0x7fff66c931e0
Segmentation fault (core dumped)
[joro@...ora prim]$ ./a.out 4611686018427387904
Bus error (core dumped)
*/
int main(int ac, char **av) {
void *p;
size_t l,cou;
l=atol(av[1]);
p=calloc(l,l);
char *pl=alloca(l);
printf("calloc=%p alloca()=%p\n",p,pl);
if (pl) {
for(cou=0;cou<l;cou++)
pl[cou]=0xcc;
}
return(0);
}
===
#include <stdlib.h>
#include <stdio.h>
/*
* calloc1.c
* * Author: Georgi Guninski
* CV: https://j.ludost.net/resumegg.pdf
[joro@...ora prim]$ gcc calloc1.c
[joro@...ora prim]$ ./a.out -1
calloc=(nil) long[l]=0x7ffe33f7e930
Segmentation fault (core dumped)
* */
int main(int ac, char **av) {
void *p;
size_t l,cou;
l=atol(av[1]);
p=calloc(l,l);
long pl[l];
printf("calloc=%p long[l]=%p\n",p,pl);
if (pl) {
for(cou=0;cou<l;cou++)
pl[cou]=0xcafebabe;
}
return(0);
}
===
===
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
