[Bug libc/26353] New: ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[Bug libc/26353] New: ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

            Bug ID: 26353
           Summary: ftw/nftw:When a large nopenfd parameter is entered,
                    ftw() or nftw() triggers stack overflow.
           Product: glibc
           Version: 2.31
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: nixiaoming at huawei dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Invoke ftw_startup() in ftw()/nftw(). 
ftw_startup() does not verify the upper limit of descriptors, and alloca is
used to apply for stack space, triggering stack overflow. 

------- code -----
io/ftw.c:
814 /* Entry points.  */
815
816 int
817 FTW_NAME (const char *path, FTW_FUNC_T func, int descriptors)
818 {
819   return ftw_startup (path, 0, func, descriptors, 0); 
820 }

833 int
834 NFTW_NAME (const char *path, NFTW_FUNC_T func, int descriptors, int flags)
835 {
836   return ftw_startup (path, 1, func, descriptors, flags);
837 }


io/ftw.c:

627 static int
628 __attribute ((noinline))
629 ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
630              int flags)
631 {
632   struct ftw_data data;
633   struct STAT st;
634   int result = 0;
635   int save_err;
636   int cwdfd = -1;
637   char *cwd = NULL;
638   char *cp;
639
640   /* First make sure the parameters are reasonable.  */
641   if (dir[0] == '\0')
642     {
643       __set_errno (ENOENT);
644       return -1;
645     }
646
647   data.maxdir = descriptors < 1 ? 1 : descriptors; /*No check upper limit.
*/ 
648   data.actdir = 0;
649   data.dirstreams = (struct dir_data **) alloca (data.maxdir
650                                                  * sizeof (struct dir_data
*));  /* Here, the stack overflows. */
651   memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *));
652

----- testcase  test_ftw.c -----
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

  #include <ftw.h>

int my_func(const char *file , const struct stat *sb ,int flag)
{
        printf("%s\n",  file);
        return 0;
}

int main(int argc, char *argv[])
{
        printf("start\n");
        ftw("/", my_func, 8192*1024);
        printf("end\n");
        return 0;
}

------ message -----
 test_ftw[15882]: segfault at fdb18398 ip 00000000f76028f5 sp 00000000fdb1839c
error 6 in libc-2.29.so[f752e000+152000]

----- coredump ---- 
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./test_ftw...done.
[New LWP 15882]
Core was generated by `./test_ftw'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xf76028f5 in ftw_startup () from /lib/libc.so.6
readline: /etc/inputrc: line 13: term: unknown variable name
(gdb) bt
#0  0xf76028f5 in ftw_startup () from /lib/libc.so.6
#1  0x0804852b in main (argc=1, argv=0xffb18554) at test_ftw.c:25
(gdb) i r
eax            0x2000000           33554432
ecx            0x0                 0
edx            0xfdb183af          -38698065
ebx            0xf76f2e24          -143708636
esp            0xfdb1839c          0xfdb1839c
ebp            0xffb18468          0xffb18468
esi            0x80485f6           134514166
edi            0x8048492           134513810
eip            0xf76028f5          0xf76028f5 <ftw_startup+101>
eflags         0x10296             [ PF AF SF IF RF ]
cs             0x23                35
ss             0x2b                43
ds             0x2b                43
es             0x2b                43
fs             0x0                 0
gs             0x63                99
(gdb) shell readelf -e core-15882-test_ftw |tail
  LOAD           0x002000 0xf76f4000 0x00000000 0x00000 0x03000 RW  0x1000
  LOAD           0x002000 0xf76f7000 0x00000000 0x02000 0x02000 RW  0x1000
  LOAD           0x004000 0xf76f9000 0x00000000 0x03000 0x03000 R   0x1000
  LOAD           0x007000 0xf76fc000 0x00000000 0x01000 0x01000 R E 0x1000
  LOAD           0x008000 0xf76fd000 0x00000000 0x01000 0x01000 R   0x1000
  LOAD           0x009000 0xf76fe000 0x00000000 0x1c000 0x1c000 R E 0x1000
  LOAD           0x025000 0xf771a000 0x00000000 0x0a000 0x0a000 R   0x1000
  LOAD           0x02f000 0xf7725000 0x00000000 0x01000 0x01000 R   0x1000
  LOAD           0x030000 0xf7726000 0x00000000 0x01000 0x01000 RW  0x1000
  LOAD           0x031000 0xffaf8000 0x00000000 0x21000 0x21000 RW  0x1000
(gdb) q

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26353] ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

--- Comment #1 from nixiaoming <nixiaoming at huawei dot com> ---
Set the descriptors upper limit or replace alloc with malloc to avoid stack
overflow.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26353] ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

--- Comment #2 from nixiaoming <nixiaoming at huawei dot com> ---
https://public-inbox.org/libc-alpha/20200808084640.49174-1-nixiaoming@huawei.com/

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26353] ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[wangxuszcn at foxmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

wangxu <wangxuszcn at foxmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wangxuszcn at foxmail dot com

--- Comment #3 from wangxu <wangxuszcn at foxmail dot com> ---
(In reply to nixiaoming from comment #0)
> Invoke ftw_startup() in ftw()/nftw(). 
> ftw_startup() does not verify the upper limit of descriptors, and alloca is
> used to apply for stack space, triggering stack overflow. 
> 
> ------- code -----
> io/ftw.c:
> 814 /* Entry points.  */
> 815
> 816 int
> 817 FTW_NAME (const char *path, FTW_FUNC_T func, int descriptors)
> 818 {
> 819   return ftw_startup (path, 0, func, descriptors, 0); 
> 820 }
> 
> 833 int
> 834 NFTW_NAME (const char *path, NFTW_FUNC_T func, int descriptors, int
> flags)
> 835 {
> 836   return ftw_startup (path, 1, func, descriptors, flags);
> 837 }
> 
> 
> io/ftw.c:
> 
> 627 static int
> 628 __attribute ((noinline))
> 629 ftw_startup (const char *dir, int is_nftw, void *func, int descriptors,
> 630              int flags)
> 631 {
> 632   struct ftw_data data;
> 633   struct STAT st;
> 634   int result = 0;
> 635   int save_err;
> 636   int cwdfd = -1;
> 637   char *cwd = NULL;
> 638   char *cp;
> 639
> 640   /* First make sure the parameters are reasonable.  */
> 641   if (dir[0] == '\0')
> 642     {
> 643       __set_errno (ENOENT);
> 644       return -1;
> 645     }
> 646
> 647   data.maxdir = descriptors < 1 ? 1 : descriptors; /*No check upper
> limit. */ 
> 648   data.actdir = 0;
> 649   data.dirstreams = (struct dir_data **) alloca (data.maxdir
> 650                                                  * sizeof (struct
> dir_data *));  /* Here, the stack overflows. */
> 651   memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data
> *));
> 652
> 
> ----- testcase  test_ftw.c -----
> #include <stdlib.h>
> #include <stdio.h>
> #include <unistd.h>
> 
>   #include <ftw.h>
> 
> int my_func(const char *file , const struct stat *sb ,int flag)
> {
>         printf("%s\n",  file);
>         return 0;
> }
> 
> int main(int argc, char *argv[])
> {
>         printf("start\n");
>         ftw("/", my_func, 8192*1024);
>         printf("end\n");
>         return 0;
> }
> 
> ------ message -----
>  test_ftw[15882]: segfault at fdb18398 ip 00000000f76028f5 sp
> 00000000fdb1839c error 6 in libc-2.29.so[f752e000+152000]
> 
> ----- coredump ---- 
> Type "apropos word" to search for commands related to "word"...
> Reading symbols from ./test_ftw...done.
> [New LWP 15882]
> Core was generated by `./test_ftw'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0xf76028f5 in ftw_startup () from /lib/libc.so.6
> readline: /etc/inputrc: line 13: term: unknown variable name
> (gdb) bt
> #0  0xf76028f5 in ftw_startup () from /lib/libc.so.6
> #1  0x0804852b in main (argc=1, argv=0xffb18554) at test_ftw.c:25
> (gdb) i r
> eax            0x2000000           33554432
> ecx            0x0                 0
> edx            0xfdb183af          -38698065
> ebx            0xf76f2e24          -143708636
> esp            0xfdb1839c          0xfdb1839c
> ebp            0xffb18468          0xffb18468
> esi            0x80485f6           134514166
> edi            0x8048492           134513810
> eip            0xf76028f5          0xf76028f5 <ftw_startup+101>
> eflags         0x10296             [ PF AF SF IF RF ]
> cs             0x23                35
> ss             0x2b                43
> ds             0x2b                43
> es             0x2b                43
> fs             0x0                 0
> gs             0x63                99
> (gdb) shell readelf -e core-15882-test_ftw |tail
>   LOAD           0x002000 0xf76f4000 0x00000000 0x00000 0x03000 RW  0x1000
>   LOAD           0x002000 0xf76f7000 0x00000000 0x02000 0x02000 RW  0x1000
>   LOAD           0x004000 0xf76f9000 0x00000000 0x03000 0x03000 R   0x1000
>   LOAD           0x007000 0xf76fc000 0x00000000 0x01000 0x01000 R E 0x1000
>   LOAD           0x008000 0xf76fd000 0x00000000 0x01000 0x01000 R   0x1000
>   LOAD           0x009000 0xf76fe000 0x00000000 0x1c000 0x1c000 R E 0x1000
>   LOAD           0x025000 0xf771a000 0x00000000 0x0a000 0x0a000 R   0x1000
>   LOAD           0x02f000 0xf7725000 0x00000000 0x01000 0x01000 R   0x1000
>   LOAD           0x030000 0xf7726000 0x00000000 0x01000 0x01000 RW  0x1000
>   LOAD           0x031000 0xffaf8000 0x00000000 0x21000 0x21000 RW  0x1000
> (gdb) q


In ftw, alloca is equal to __builtin_alloca, and as the gcc manual says,"
Since the __builtin_alloca function doesn’t validate its argument it is the
responsibility of its caller to make sure the argument doesn’t cause it to
exceed the stack size limit."[1]

Stack may be corrupted here, Can we apply for a CVE ?

[1] __builtin_alloca do not validate args:
https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26353] ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

--- Comment #4 from nixiaoming <nixiaoming at huawei dot com> ---
patch v2

https://public-inbox.org/libc-alpha/20200815070851.46403-1-nixiaoming@huawei.com/

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26353] ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow.

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26353

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

--- Comment #5 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Fixed on 2.33.

-- 
You are receiving this mail because:
You are on the CC list for the bug.