thepowersgang / acess2 Goto Github PK

thePowersGang: According to a grep of unsigned char in my libc, which isn't entirely finished with these fixes, you probably need to audit: strcasecmp, memset, strncmp, memrchr, strchrnul, strcmp, stresep, strrchr, memchr, strncasecmp, memccpy, memcmp, fputc family, fgetc family, btowc, and wctob. (If you have them)

In addr.c in void DumpInterface(const char *Name) there is declared line 156 char path[sizeof(IPSTACK_ROOT)+1+FILENAME_MAX+1] = IPSTACK_ROOT"/";.
This makes path a fixed size char array.
In the next line strcat(path, Name); strcat is used to append the function parameter Name to path. DumpInterface is only used at line 65 DumpInterface(argv[1]); in addr_main which finally gets called in Main.c with DumpInterface(argv[1]);.
Putting this together argv[2] is passed as Name to DumpInterface and can be any string. In particular a string longer than IPSTACK_ROOT)+1+FILENAME_MAX+1 making it overflow path with user controlled data.

An example would be simply executing ip addr AAAAAAAAAAA (...).

Dropbear crashes when a substantial amount of data is received (e.g. opening irssi) with a segfault early in zlib's inflate() function. Possibly buffer overrun or initialized value.

If you have these interfaces, you should audit them for whether they use unsigned char semantics (rather than signed char) as required by the standard: strcasecmp, memset, strncmp, memrchr, strchrnul, strcmp, stresep, strrchr, memchr, strncasecmp, memccpy, memcmp, fputc family, fgetc family, btowc, and wctob. Note also the <ctype.h> functions such as isspace has the domain of EOF and values representable as unsigned char, anything else is undefined behavior.

For instance, the sort order in strcmp is wrong.