[Bug libc/13337] New: load_shobj(): Fix readlink() buffer termination handling

[Bug libc/13337] New: load_shobj(): Fix readlink() buffer termination handling

[thomas.jarosch at intra2net dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13337

             Bug #: 13337
           Summary: load_shobj(): Fix readlink() buffer termination
                    handling
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: thomas.jarosch@intra2net.com
    Classification: Unclassified


Created attachment 6029
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6029
Patch to fix the issue

>From the patch:

load_shobj(): Fix readlink() buffer termination handling

readlink() never zero terminates the buffer.
load_shobj() calls readlink() like this:

   "if (readlink (origprocname, origlink, PATH_MAX) == -1)"

It tried to compensate for the missing zero termination
with this line of code:

    origlink[PATH_MAX] = '\0';

This is wrong as the content of the 'origlink' buffer
will probably be shorter than PATH_MAX and therefore
contains an unterminated string + garbage.

Fix it by terminating the string properly. Also lower
the buffer size to PATH_MAX, that should be more than enough.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13337] load_shobj(): Fix readlink() buffer termination handling

[thomas.jarosch at intra2net dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13337

--- Comment #1 from Thomas Jarosch <thomas.jarosch at intra2net dot com> 2011-10-24 15:13:10 UTC ---
btw: urban dictionary states this bug # is the postal code
of "Fly Creek, New York". Very l333t :o)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13337] load_shobj(): Fix readlink() buffer termination handling

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13337

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-29 16:52:38 UTC ---
I've checked in a patch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13337] load_shobj(): Fix readlink() buffer termination handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13337

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Flagging as security- because it is unlikely that a trust boundary is crossed
in the sprof tool.

-- 
You are receiving this mail because:
You are on the CC list for the bug.