Bug 19351 - MANSECT and -S overflow
MANSECT and -S overflow
Status: CLOSED CURRENTRELEASE
Product: Red Hat Linux
Classification: Retired
Component: man (Show other bugs)
6.2
All Linux
medium Severity high
: ---
: ---
Assigned To: Bernhard Rosenkraenzer
Aaron Brown
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2000-10-18 19:54 EDT by Tim
Modified: 2008-08-01 12:22 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-10-19 08:05:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tim 2000-10-18 19:54:03 EDT
From my post to the mailing list security-audit:

...I found another more interesting bug in the way the MANSECT environment 
variable and the -S command line option are parsed. get_section_list() is 
called on the contents of both of these variables to split the ':'-
separated 
lists into arrays. The array that the split off pieces are put in is 
defined 
as: 
    static char *tmp_section_list[100]; 
The check tries to stop get_section_list() writing past the 100th element 
is flawed: 
    if (end == NULL || i+1 == sizeof(tmp_section_list)) 
On my system, sizeof(tmp_section_list) is 400; 100 4-byte pointers. 
Clearly, 
the test expression should be something like this: 
    sizeof(tmp_section_list)/sizeof(tmp_section_list[0]) 
I haven't had much time to play with it, but I know what by supplying more 
than 100 ':'-separated items, _something_ gets clobbered and strange 
things 
happen eg. invoking apropos and whatis when I didn't ask for them. I'm not 
an exploit writer, so I'm not sure how exploitable the bug is, but it 
looks 
like there would be a way if you could make use of the return values of 
strdup().
Comment 1 Bernhard Rosenkraenzer 2000-10-19 08:05:16 EDT
Looking into it
Comment 2 Bernhard Rosenkraenzer 2000-10-19 08:29:19 EDT
Ok, fixed in 1.5h1-14, passing it on to QA.

Note You need to log in before you can comment on or make changes to this bug.